Bedrock access

Warden’s agents call models through Amazon Bedrock, in your own AWS account. The prompts, the evidence and the answers stay there. Nothing is sent to us or to any other model provider.

The roles

Each agent job runs on a role. Each role has an ordered list of model ids, pinned in the release’s models.lock; setup takes the first one your account can call, records the choice, and shows it on the console’s Agents page. This table is generated from the release’s lock (commit b44081aa7642, pinned 2026-10-19).

How to enable access

1. Open the Amazon Bedrock console in the region Warden’s hub runs in, and go to Model access.
2. Request access, for each role, to at least the first model the table lists. The refuter needs one model from a maker other than the drafting roles’ maker.
3. Anthropic models ask for a one-time use-case form on the model-access page. Fill it in once for your account; the answer covers each Anthropic model the roles use. Some models are offered through AWS Marketplace and ask you to accept a subscription first.
4. Run warden setup again. It probes each role and records the models it will use.

Setup does the checking for you. It lists what the account has, sends one probe per role with a one-token answer (a fraction of a cent), and names the exact page and the words to click for any role that is missing. It probes twice, as you and as Warden’s invoke role, and explains any difference, such as a marketplace subscription. It reads your on-demand quotas and states them.

If your hub region has no capacity for a model, setup offers a geographic cross-region inference profile (us., eu. or apac.) and names the geography. Global profiles move data out of the geography, so they need a keeper’s signature.

Quotas

Bedrock’s on-demand quotas are set per model and per region, in requests per minute and tokens per minute; the Service Quotas console lists them under Amazon Bedrock. Setup reads the quotas for the models it chose and states them. A call sends at most its role’s input tokens from the table above, so a role’s quota in tokens per minute divided by that cap is how many of its calls fit in a minute.

What the agents need at peak, in tokens per minute for an estate of a given size, is not measured yet. It comes from the token profile the replay harness measures, and this guide will publish it once that profile is measured.

What it costs

Bedrock bills your AWS account for the tokens the agents use, at the model’s list price. Warden keeps that bounded in code:

An expected month for an estate of a given size is not measured yet, for the same reason as the peak token rate, so this guide publishes the ceilings and the per-call bound below rather than an estimate. A quiet tick, with no new finding and no lane hit, makes no model call. Any keeper can lower a ceiling; raising one takes a signature. The console’s home page shows today’s spend against each ceiling, and the Agents page shows every call, its tokens and its cost.

The list prices, from the release’s price table (data/model-prices.json), per million tokens in USD, and the most one call of each role can cost on its first model: every input token and every output token its caps allow, at list price.

An attacker who floods the estate with findings to burn the budget gains little: findings from one lineage are triaged as one unit, the attack reserve opens only when code sees an active attack, and each case has its own cap. Rules, cases, swarm detection and response plans never depend on the budget.

What the invoke role can do

Model calls use one role, Wardensec-Agent-Invoke, in the hub account. Its only permission is bedrock:InvokeModel on the pinned model and inference-profile ARNs. It cannot read your estate, and the read roles cannot call models. Where the hub has a Bedrock interface endpoint, its policy admits only that role and those models.

If model invocation logging is on in your account, the prompts land in your own log destination. They hold handles and fixed vocabulary, not the names in your estate. The Agents page states whether logging is on.

Without model access

Warden runs rules-only. Every finding, case, status, actor, swarm, blast radius and response plan still comes from code, because none of them depends on a model. What you lose is the narrative on a case, triage calls on findings, hunting leads and hardening proposals, and the chat.

Rules-only is never silent. It is stated on the Now page, on the Agents page, in every run report and in every e-mail footer. Turning agents on later is a signed setting; no reinstall is needed.

The same holds when a day’s budget is reached or Bedrock throttles: the page says where the narrative stopped and why, and the rest continues.