DEV Community

AI Agent Governance on AWS: Block Agents, Prove EU AI Act Compliance

Sarvar Nadaf on September 29, 2026

Every fact here is verified against an actual run (Amazon Nova Pro us-east-1 on-demand, Strands Agents, and traccia 0.1.29 $0.0008 per 1K input an...
Collapse
 
sarvar_04 profile image
Sarvar Nadaf AWS Community Builders •

🎥 𝗪𝗮𝘁𝗰𝗵 𝘁𝗵𝗲 𝗵𝗮𝗻𝗱𝘀-𝗼𝗻 𝗱𝗲𝗺𝗼

I walk through the AWS Strands multi-agent governance setup, runtime blocking, and the EU AI Act evidence flow.

👉 youtu.be/KO7IZ75rpqY?si=reDdwwwuzV...

Would love to hear your thoughts on AI agent governance in production. 🚀

Collapse
 
steven_r_404 profile image
Steven Ray •

combination of AI agent governance, runtime enforcement, and audit evidence makes this especially relevant for teams building production AI systesm on aws cloud.

Collapse
 
sarvar_04 profile image
Sarvar Nadaf AWS Community Builders •

Yes it will definitely help building production ai systems on aws.

Collapse
 
salman_khan_c31307505285e profile image
Salmankhan •

This gonna assist better in production if we give it chance

Collapse
 
sarvar_04 profile image
Sarvar Nadaf AWS Community Builders •

Yes for sure

Collapse
 
kyisaiah47 profile image
Isaiah Kim •

Does the spend policy aggregate cost across the parent run and delegated spans, or does each sub-agent receive its own budget?

Collapse
 
sarvar_04 profile image
Sarvar Nadaf AWS Community Builders •

good question, and it's the thing that tripped me up too. spend cap aggregates per run, not per sub-agent. there's no separate budget handed to each delegated agent. the platform reconciles cost against the trace/run id, so the parent run and everything it delegates roll up into one number that gets checked against the one ceiling.

the catch i hit: the sdk only supplies the signal for a spend cap on actual llm_call events (it sends remaining_budget_usd, input tokens, model, then settles reserved vs actual after). in this crew the model calls go through strands' bedrock client, which isn't an auto-patched client, so the spend cap had almost nothing to meter, and the tool spans themselves are basically $0. that's exactly why the spend cap denied nothing here and i had to reach for a loop cap instead, which counts tool calls per run.

so the mental model: budget is a run-level pool, aggregated across parent + delegated spans, enforced server-side against the trace id. if you want to catch
a specific sub-agent you don't give it its own budget, you scope the policy to that agent's identity (i scoped the loop cap to credit-risk because that's the run_identity active when the tools actually fire, not the entrypoint). happy to share the decision log screenshot if it helps.

Collapse
 
mustkhim_inamdar profile image
Mustkhim Inamdar •

Excellent work

Collapse
 
sarvar_04 profile image
Sarvar Nadaf AWS Community Builders •

Thank You!