What you do (and what you never have to change)
- Keep calling Bedrock exactly as today. No proxy, no key sharing, nothing moves.
- At design and CI time, call the engines (recommend_engine, router, token-estimator) with Bedrock catalog pricing to pick model families and set budgets before anything ships.
- Monthly: drop your CUR / Cost Explorer export (or invocation logs) into the actuals file-inbox. We reconcile modeled vs billed and export FOCUS 1.x.
- Governance: model-eligibility gates encode which Bedrock models are permitted per workload; if you also run a gateway, the policy exports as an executable policy_patch.
DAILY costs - you never wait for the invoice: Turn on Bedrock model invocation logging: token-level JSONL lands in S3 near-real-time. Drop it (gunzipped) into the actuals inbox as bedrock-*.jsonl - daily, per-model, per-agent rows, no CUR wait.
And the same engines that price it recommend the fix: cheaper eligible models, caching and batch wins, plan-vs-API breakpoints - refreshed as your usage lands, so optimization is a daily habit, not a quarterly project.
What you'll see on the showback dashboard
$ / dayby modelby workloadby agenttokens in/out + cachemodeled vs billed drift
Per-agent attributionPass requestMetadata: { workload, agent } on every Converse/InvokeModel call (up to 16 pairs) - it lands verbatim in the invocation log and becomes your showback dimensions.
Actuals pathAWS CUR export -> file-inbox -> reconciliation + FOCUS 1.x
What we never ask you to do
Never in your inference path. Latency, availability and data flow are untouched.
Never holding your keys. Actuals arrive as telemetry and exports you already generate.
Never a migration. The decision layer meets your estate where it is.