paybondpaybond
Sign in

Approve AWS spending with agents

Use the aws policy preset to cap EC2 and cloud operator tools — Harbor verify before side effects, auto-evidence after, and defaultDeny for unregistered calls.

Agents that manage cloud infrastructure can rack up real cost in one tool call. Paybond's aws preset gives you a reviewed starting policy: side-effecting EC2 operations are capped, read-only describe calls pass through, and default_deny: true blocks anything not registered.

Presets are starting points

paybond policy init --preset aws writes an editable local paybond.policy.yaml. Raise caps, add RDS or Lambda tools, and commit the file — bundled YAML is not an immutable contract.

Try it

Terminal
Terminal commandSwipe to inspect long lines
paybond login
paybond agent sandbox smoke \
  --preset aws \
  --operation aws.ec2.start_instance \
  --requested-spend-cents 5000 \
  --evidence-preset cost_and_completion \
  --result-body '{"status":"completed","cost_cents":5000,"instance_id":"i-smoke"}' \
  --format table

Scaffold the aws preset

Terminal
Terminal commandSwipe to inspect long lines
paybond policy init --preset aws --out paybond.policy.yaml
paybond policy presets show aws
paybond policy validate-tools --file paybond.policy.yaml --local-only

Optional: raise the budget when scaffolding:

Terminal
Terminal commandSwipe to inspect long lines
paybond policy init --preset aws --max-spend 1000 --out paybond.policy.yaml

Bundled defaults include:

ToolSide effectingCap
aws.ec2.start_instanceYes$500 per call / $500 intent budget
aws.ec2.describe_instancesNo—

Wire middleware

Use the preset inline or from the scaffolded file:

paybond-session.ts

Code exampleSwipe to inspect long lines
import { Paybond } from "@paybond/kit";

const paybond = await Paybond.open({ apiKey: process.env.PAYBOND_API_KEY! });

const instrumented = await paybond.instrument({
  policy: "aws", // or "./paybond.policy.yaml"
  tools: {
    "aws.ec2.start_instance": startInstance,
    "aws.ec2.describe_instances": describeInstances,
  },
});

Sandbox quickstart:

Terminal
Terminal commandSwipe to inspect long lines
paybond init --solution aws --max-spend-usd 500 --framework generic --non-interactive

Extend for your operator catalog

Add tools to the policy file and registry together — CI catches drift:

tools:
  aws.rds.start_instance:
    side_effecting: true
    max_spend_cents: 100000
    evidence_preset: cost_and_completion

Re-run paybond policy validate-tools --file paybond.policy.yaml --remote after paybond login to catch Harbor template head drift.

Developer reference: /docs/kit/agent-policy.