Get In Touch
a

Earlier posts in this series built the pieces that make AI traffic governable: a billing-grade usage-metering gateway that turns raw model calls into priced, auditable usage; an inline governance plane that meters, redacts, and audits without adding inference latency; and customer-owned sign-in, which moved identity onto the customer’s own proxy with one revocable key per machine.

Each of those answered “how much did we spend” and “who is allowed in.” This week closed the gap between them: who actually spent it, measured at the Bedrock call itself. Until now every request reached Bedrock under the account’s own IAM role, so usage was real but attribution rolled up to the gateway, not the human. Here is what shipped and why it is built this way.

The Core Change: Each Person Signs Their Own Calls

The governance post described model invocation using the customer account’s own IAM role. That is correct for the data boundary (nothing leaves the account), but it means every call looks the same to Bedrock. So we added a layer underneath: Nexus now mints a short-lived AWS session per person and signs that person’s Bedrock calls with it.

A small STS minter and a per-person session cache live in the proxy. One function is responsible for naming a person’s Bedrock session, and its behavior is pinned by a test corpus so the naming cannot silently drift between releases. The verified AWS principal ARN flows through to a sealed stamp on the usage event, on both the first-request path and the cache-hit path, so the attribution survives caching. That stamp is what lets every downstream report say “this many tokens, this cost, this person,” instead of attributing everything to the role.

Because the session is short-lived and minted from the already-verified identity, this adds per-user granularity without putting a long-lived credential anywhere, consistent with the no-static-secrets stance from the sign-in work.

A Security Fix Found Along the Way

Building this surfaced something worth fixing on its own: a client’s request could influence which credentials Bedrock was ultimately called with. We closed that. A request can no longer choose the credentials behind its own Bedrock call; credential selection is driven entirely by the verified identity, never by anything the caller supplies.

If you run any proxy that signs upstream calls, this is the first trap to check for. The caller should never get a vote on which role or session its request runs under.

Privacy by Design: Pseudonymous Billing IDs

Attributing cost to a real person raises an obvious concern: not every organization wants individual names in a billing system. So attribution is an install-time choice, not a default imposed on everyone, which fits the “your account, your rules” posture of the rest of Nexus.

At install, an admin picks the billing-identity mode: email, or pseudonymous. In pseudonymous mode, the recorded principal is the role ARN without the session name, so usage still rolls up per person for cost purposes without carrying the person’s identity into billing records. The choice is sticky across upgrades and is refused on older bootstrap versions that cannot enforce it, so a routine upgrade can never quietly downgrade the organization’s privacy posture. The billing-identity key is retained even through a delete, so the setting cannot be lost by accident.

Seeing It: The Attribution API and Dashboard

Signing calls per person is only useful if you can read the result. Two surfaces make it visible, and both inherit the metering discipline from the usage-gateway post.

The Usage API answers the last 24 hours of an organization’s Bedrock calls broken down by attribution, and it is careful about what counts: a request refused before it ever reached Bedrock is not counted as usage, and a model fallback that was superseded is not double-counted as a failed or partial request. Cost is reported per token class and per model, with fallbacks attributed correctly, in both JSON and CSV, the same priced, reconcilable numbers the metering gateway produces.

On the admin side there is now a billing-attribution card on the organization usage tab, with a per-row class breakdown, a “fell back” column, and a people view that can show the billing identity for each person. It is backed by a fallback alarm and a dashboard row, so if attribution ever stops flowing you learn it from an alarm rather than from a confusing invoice.

Why This Matters

Metering tells you how much your organization spent on AI. Attribution tells you where it went. That difference is what turns a Bedrock bill from a single scary number into something you can manage: set per-person expectations, spot the runaway automation, charge costs back to the right team, and do it without forcing names into billing if you would rather not.

It also matters more every month, because the traffic is less and less human. As the governance post noted, an autonomous agent that plans, writes, and merges code generates orders of magnitude more model traffic than a person does. When most of your spend comes from agents acting on behalf of people, “which person’s work drove this cost” is exactly the question per-user attribution answers.

The spend was always happening. The point of a governed gateway is that now you can see whose it is.

Related Reading

This kind of per-identity cost attribution is exactly what the higher levels of the AI-DLC maturity model require. Enterprise AI infrastructure, inside your own VPC. Details at nexus.allcode.com.