A multi-account setup a two-to-twenty person team can run without a platform team: which accounts to create, three service control policies worth having on day one, human access through IAM Identity Center, and CI access through OIDC.
Read ArticleModel spend is hard to control because it's hard to see: one invoice, many callers, and agent sessions whose cost varies by orders of magnitude. The order that works is to attribute every call, cap spend per session and per caller, and only then optimise.
Read ArticleChoosing a runtime for agents on Google Cloud comes down to session length, GPUs and how much you want managed. The limits that decide it, and the IAM detail that matters most: iam.serviceAccounts.actAs, Google Cloud's equivalent of AWS's PassRole.
Read ArticleFour reasonable homes for an agent on AWS, chosen mainly by how long a session runs, whether it holds connections, and how much of the runtime you want to operate. A decision table, the limits that force the choice, and the IAM each one needs.
Read ArticleOnce several services call several model providers, put a gateway between them. What belongs in it (credentials, budgets, logging, failover), what doesn't (prompt logic), and the two features that quietly change model behavior: cross-model failover and semantic caching.
Read ArticleMost agents call a hosted model API and need no GPU at all. When self-hosting a model does make sense, the decision comes down to memory, throughput and utilization. How to size the GPU and work out the break-even against API pricing with your own numbers.
Read ArticleThis site's publish pipeline pointed at an S3 bucket that never existed, and nobody noticed for ten months because an earlier step always timed out first. What that incident teaches about pipelines for agent deployments, where skipped checks can hide an untested deployment path.
Read ArticleAsk a coding agent for an orchestrator role that launches ECS tasks and you will often get ecs:* and an unconditioned iam:PassRole. Here is the escalation path when a privileged role trusts ECS, the scoped version, and a checklist for reviewing agent IAM before merge.
Read Article