Runs in your own AWS account·Bedrock-first

One governed front door to AI.

Agents, knowledge and apps for every team, on department budgets, with an audit row for every call.

Book a demo Talk to ECV

01Signed in · Entra IDtran.mai@ecloudvalley.com

02Sales budget · 62% of $5,000$3,120 spent this month

03Model allowed for SalesClaude Sonnet 4.5 via LiteLLM

04Guardrail · 1 value maskedphone number → [PHONE]

05Audit row · 14:32:08 · $0.021user · dept · agent · model · cost

Summarise our Q3 pricing vs. two competitors5 checks passed

Our Standard tier is $4,200 a month, about 6% below the average of Fabrikam's and Litware's public list prices12. Premium sits level with both.

Sales Research Agent Claude Sonnet 4.5 Billed to Sales ≈ $0.02

Built on AWS and the identity stack you already run

Amazon Bedrockmodels
AgentCoreagent tools
LiteLLMmodel gateway
Microsoft Entra IDsign-in · SCIM
Oktasign-in · SCIM
Keycloakidentity broker
SharePointknowledge sync
pgvectorknowledge search
MCPconnected apps

The problem

AI adoption started without you.

Every department bought its own AI. Nobody knows where the data went, what it cost, or who still has access.

No governance

Data goes to whichever AI each employee signed up for.

No cost control

AI spend on a dozen credit cards. No owner.

No identity lifecycle

People who left still have the login.

No shared leverage

Your best prompts live in personal accounts.

How it works

One request, start to finish.

Prepare a one-page renewal brief for Contoso Logistics: their usage this year, our Q3 pricing, and how two competitors compare. Then log a follow-up in Jira.

Working · 4s

Thinking: start from Contoso’s account history, then our Q3 rate card, then two public price lists. Confirm which competitors matter before drafting.
Made a plan· 4 tasks

Tasks 1/4· Compare Q3 pricing with two competitors

Read Contoso’s account historySales playbook
Compare Q3 pricing with two competitors
Draft the one-page brief
Log a follow-up in Jira

Add an update while the agent works…

Sales Research Agent· Claude Sonnet 4.5Medium

Prepare a one-page renewal brief for Contoso Logistics: their usage this year, our Q3 pricing, and how two competitors compare. Then log a follow-up in Jira.

Working · 9s

Public internet

Made a plan· 4 tasks
Searched knowledge base Sales playbook· 4 passages
Read Contoso-usage-2026.xlsx· 3 sheets
Searched the web for “managed cloud pricing”· 3 pages
Ran a calculation· Code Interpreter

I have this year’s usage and two competitors’ list prices. Checking which competitors you want in the brief.

Add an update while the agent works…

Sales Research Agent· Claude Sonnet 4.5Medium

Prepare a one-page renewal brief for Contoso Logistics: their usage this year, our Q3 pricing, and how two competitors compare. Then log a follow-up in Jira.

Worked for 11s· searched knowledge and the web

Public internet

Agent needs you · Answer to continue

Which two competitors should the brief compare?

Question 1 of 1 · pick one or type your own

1Fabrikam and LitwareRecommendedNamed in the last two renewal calls

2Fabrikam and Adventure WorksClosest list prices this quarter

Type a different answer…

Skip — let the agent decideNext

Answered · 1 question

Which two competitors should the brief compare?

Fabrikam and Litware

Agent needs you

Approve 1 change in Jira

Nothing changes until you approve. Runs as you, under your own access. Your organisation set Jira to Ask before each action.

Create issueMakes changesJira · connected with your account Deny Approve

WhereSALES › Renewals

Respond above to continue…

Sales Research Agent· Claude Sonnet 4.5Medium

Answered · 1 question

Fabrikam and Litware

Approved by you · created 1 issue Jira

Contoso Logistics ran 18% more managed-services hours this year1. Our Q3 Standard tier is $4,200 a month2, about 6% below the average of Fabrikam and Litware’s public list prices3. The brief is ready and the follow-up is in Jira.

2Q3 rate card· Knowledge base Sales playbook · page 3

“Standard managed-services tier: $4,200 per month, billed annually.”

Contoso Logistics renewal briefDocument · v1 Open in Artifacts

Sales Research Agent Claude Sonnet 4.5 Billed to Sales ≈ $0.03

3 sources

Reply to Sales Research Agent…

Sales Research Agent· Claude Sonnet 4.5Medium

Runs survive a refresh

3 / 4 · Asks when it should

Capabilities

Everything your teams reach for, in one governed place.

Agents, knowledge, artifacts, memory and apps, behind one sign-in.

Agents

Instructions, skills, tools and knowledge. Configuration, never a new server.

Knowledge

Synced from SharePoint. Cited, and only what you may open.

Artifacts

Documents, decks, sheets and web apps. Every version kept.

Memory

Read, edit or delete it. Only you can see it.

Connected apps

One MCP gateway, permissions per app. Changes ask first.

Also included

Models on Amazon Bedrock
Shared skills & prompts
⌘K search
Files and scans
Resumable runs

Department agents

Built for how your company works.

Agents for Sales, HR, Legal and Finance on one host. Configuration, not infrastructure.

Sales Research Agent

Shared with Sales

InstructionsResearch competitors, accounts and cloud market news. Cite the date of each price.

ToolsWeb research

KnowledgeMarket reports

ModelClaude Sonnet 4.5

People Policy Agent

Shared with everyone

InstructionsAnswer leave, benefits and onboarding questions from the HR handbook only.

ToolsKnowledge search

KnowledgeHR handbook

ModelClaude Haiku 4.5

Contract Reviewer

Shared with Legal, Sales

InstructionsCheck contracts against our standard terms. Flag risky clauses by number.

ToolsRead files

KnowledgeContract templates

ModelClaude Sonnet 4.5

Finance Analyst

Shared with Finance

InstructionsTurn cost exports into tables and charts by department and month.

ToolsCode Interpreter

KnowledgeFinance policies

ModelAmazon Nova Pro

One agent host

Loads each agent per message, in your AWS account.

Loaded for this message

Sales Research AgentWeb researchMarket reportsClaude Sonnet 4.5

People Policy AgentKnowledge searchHR handbookClaude Haiku 4.5

Contract ReviewerRead filesContract templatesClaude Sonnet 4.5

Finance AnalystCode InterpreterFinance policiesAmazon Nova Pro

4agents

1host

0new deploys

LiteLLM gateway

Amazon Bedrock Billed to the asker's department

Built by admins or members

Self-service. Admins can switch member building off.

Shared by rules, not by owner

Allow by department, group or person. Deny wins.

Cost follows the person asking

Any agent bills the asker's own department.

Governance

Access you can explain.
Deny always wins.

Groups decide what people see. Departments decide who pays. One deny overrides every allow.

eCloudvalley

Organisation · one per deployment

Users

Synced from Entra ID via SCIM.

TMTran MaiSales

PQPham QuangSales

KPKim PhamPortal Operations

Many groups · one department

Groups

Add roles. Named in sharing rules.

ContractorsSales southRegional managersPlatform team

Financegrants Cost Analyst

Never holds budget

Departments

Own budget, limits and models.

Sales62%

Marketing86%

Generalcatches everyone else

One per person · a direct list

Resources

Org-level. Each has its own sharing rules.

Agents Skills Prompts Knowledge Apps Artifacts

Allow, minus deny · deny wins

by department by group by person

Roles answer what you can do.

Visibility answers which things.

Departments answer who pays.

1Access check

Check anyone against anything.

Pick a person and a resource. The first deny ends the check.

Person

Resource

Hidden

Tran Mai is in Contractors. Deny always wins, even over Sales.

Checked in this order

DenyContractors
Everyone
Owner
Allow list

Chats bill to Sales either way

Permission Owner Org admin Member Cost Analyst Compliance Reviewer Department Lead

Usage and spend

See every department's usage

See own department's usage

Change budgets and limits

Audit

Read the audit log

Export the audit log

Never given to a custom role

Manage billing Can't be given to a custom roleBilling stays with the Org Owner. A custom role can be renamed or re-scoped, never raised past this ceiling.

Change organisation settings

Act as another person

2Roles

Custom roles, with a ceiling.

One built-in role each; groups add custom roles on top.

Billing stays with the Org Owner.
Settings and acting as others stay with admins.
Member-built agents never exceed their creator.

Seeded custom roles

Department LeadCost AnalystCompliance ReviewerKnowledge CuratorAgent Curator

Cost control

Every AI dollar has an owner.
Known before the invoice.

Each department gets a monthly budget, enforced at the model gateway before the next call.

department billed per request

Unassigned people land in General.

80%

soft alert, seeded

Flags the department, refuses nothing.

100%

hard stop at the gateway

Next call refused until reset or raise.

policy tiers

Organisation, department, person. Most specific wins.

Admin console/Budgets & limits October 2026Enforced at the gateway

Budgets & limits

Each department has a monthly budget, shared equally across its active people. A person can be given their own limits instead.

3 people with their own limits

Monthly budgets

$13,000

5 departments

Spent in October

$8,940

69%

Past warning

Marketing at 86%

Stopped

General · chats refused

Resets

Nov 1

Monthly, every department

DepartmentMonthly budgetSpentUsedStatusSpeed limits

General31 people · System$1,500$1,500100%Stopped60 rpm · 24,000 TPMOrganisation defaults

Marketing18 people$1,500$1,29086%Past warning60 rpm · 20,000 TPMOwn limits

Portal Operations9 people$3,000$1,94065%Within budget120 rpm · 400,000 TPMOwn limits

Sales40 people$5,000$3,12062%Within budget120 rpm · 400,000 TPMOwn limits

Customer Success22 people$2,000$1,09055%Within budget60 rpm · 24,000 TPMOrganisation defaults

Alert at 80%Within budgetPast warningStopped at 100%

Every reply

The cost of every reply, per model call.

Each call costed and logged, then grouped by turn.

Our Standard managed-services tier is $4,200 a month1, about 6% below the average of two public list prices2.

Sales Research AgentClaude Sonnet 4.5Billed to Sales≈ $0.02

This turn · 4 model callstokens in / out

1Plan the search · Claude Sonnet 4.51.1K / 60$0.004

2Read knowledge results1.6K / 80$0.006

3Read web results1.3K / 70$0.005

4Write the answer1.0K / 210$0.006

Turn total · billed to Sales$0.021

Audit row14:32:08 · tran.mai · Sales · 4 model calls · $0.021

Budget requests

Ask for more budget. An approver decides.

Approved as written. Spend still counts to the department.

Models by department

Choose models per department.

Block what a department shouldn't spend on.

Rate limits

Rate limits that clear on their own.

Per-minute caps. The agent pauses briefly and retries.

Usage by person, department, model and day.

Cost Analyst role sees all spend.

Personal limits still bill the department.

Bedrock usage on your own AWS bill.

See budgets and per-reply cost in a live walkthrough.

Talk to ECV Book a demo

Audit & guardrails

Accountability for every call.

An audit row for every model call. Sensitive data masked before the AI sees it.

An audit row per model call

Who, which department, agent and model, what it cost and when. Written once.

Masked before the AI sees it

Block, mask or flag wherever text enters. Vietnamese IDs built in.

A second admin for transcripts

Reading someone's chats needs another admin's approval, never the requester's. It expires on its own.

Inside your AWS account

It runs in your AWS account. Not someone else's.

Your own deployment, from the same templates. A Bedrock call stays in your account.

1Public entranceCloudFront. All else private.

0Hosts reachable from the internetNo public IP, no open shell.

1Organisation per deploymentYour stack, your data.

Click any part to see what it does.

Your AWS account One organisation Your IAM, network and region

Public edge

Private network

Data hostattached volume

AWS services

No public IP
No key pair
No listening shell

AWS services

Amazon Bedrock

Your IAMStays in your account

Claude, Nova, Llama and more, under your IAM. The call stays in your account.

9 / 15

Security & identity

The answers your security review asks for.

Enforced in Keycloak, the API, the gateway and the agent layer.

Talk to ECV Book a demo

Single sign-on through Keycloak

OIDCEntra ID · Okta

SCIM provisioning

joiners · leavers

Custom roles with a ceiling

billing · owner only

Per-resource visibility

deny always wins

An audit row for every model call

plus transcript reads

Guardrails at four checkpoints

fails closed

Approvals for connected apps

ask before each action

User-delegated OAuth

per-person OAuth

Data and secrets in your account

single-tenant

Encryption at rest and backups come from your account's own stack, confirmed per deployment with eCloudvalley.

Who it’s for

For everyone who signs off, and everyone who logs in.

IT, security, finance, department heads and employees. One portal, the right view for each.

Pick a role ←→

For CIO & IT

One AI platform, on the cloud you already run.

Replace scattered subscriptionsOne portal for every team, on Amazon Bedrock.
One admin consolePeople, models, apps, budgets and audit in one place.
Joiners and leavers, handledSCIM from Entra ID or Okta.

See the admin console in a demo

Delivered by ECV

From a fresh AWS account to company-wide AI.

eCloudvalley, an AWS Premier Tier Services Partner, deploys it into your account from the same templates for every customer.

Talk to ECV

No custom code per customer

01
Discover
Region, identity provider, models, departments and an infrastructure estimate.
02
Deploy into your AWS account
From your own infrastructure repository.
03
Connect identity & SharePoint
A guided wizard connects sign-in, models and documents.
04
Pilot one department
One team's budget, models, guardrails and agents, with real usage.
05
Roll out
Add departments as you go. Nothing to install.

About eCloudvalley

Born in the cloud in 2013, eCloudvalley is an AWS Premier Tier Services Partner delivering end-to-end cloud services across Asia Pacific.

800+employees
14countries
5,000+customers

150+ successful migrations
200+ successful implementations
100+ active managed services customers
AWS AI Competency Agentic AI Consulting

Your own infrastructure repoEvery change reviewable.

Break-glass access onlyYour admins work in one console.

Admin enablementBudgets, models, guardrails and agents, walked through.

Ready to plan your rollout?

Book a demo

Data & security02

In your own AWS account: database, files and audit, with model calls going to Amazon Bedrock in the region you choose. Optional keys for other providers send those calls to that provider, only after admin approval.

Not freely. It takes a time-boxed grant approved by a different person, and every read is logged.

Models & cost02

Any Amazon Bedrock model your account can reach, through one gateway. Admins choose which models each department may use.

You pay AWS directly for infrastructure and Bedrock usage, and every department has a budget with a hard stop. ECV gives you an infrastructure estimate and a quote up front.

Deployment & support02

It is designed to go from a fresh AWS account to a running portal in a day. A guided wizard then connects sign-in, models and SharePoint.

Yes, for content: chat, scanned documents, search and guardrails all handle Vietnamese. The interface is in English today.

Book a demo

See it running in your own AWS account.

An eCloudvalley specialist shows it with your sign-in, models and budgets, then plans the deployment with you.

Talk to ECV

Book a demo

We’ll tailor the walkthrough to your team.

Request received

Thanks. An eCloudvalley specialist will email you to set up your demo.

One governed front door to AI.

AI adoption started without you.

No governance

No cost control

No identity lifecycle

No shared leverage

One request, start to finish.

Everything your teams reach for, in one governed place.

Agents

Knowledge

Artifacts

Memory

Connected apps

Built for how your company works.

Built by admins or members

Shared by rules, not by owner

Cost follows the person asking

Access you can explain.Deny always wins.

Check anyone against anything.

Custom roles, with a ceiling.

Every AI dollar has an owner.Known before the invoice.

The cost of every reply, per model call.

Ask for more budget. An approver decides.

Choose models per department.

Rate limits that clear on their own.

Accountability for every call.

An audit row per model call

Masked before the AI sees it

A second admin for transcripts

It runs in your AWS account. Not someone else's.

Amazon Bedrock

The answers your security review asks for.

Single sign-on through Keycloak

SCIM provisioning

Custom roles with a ceiling

Per-resource visibility

An audit row for every model call

Guardrails at four checkpoints

Approvals for connected apps

User-delegated OAuth

Data and secrets in your account

For everyone who signs off, and everyone who logs in.

One AI platform, on the cloud you already run.

Policy enforced below the UI, with evidence.

Every AI dollar has an owner.

AI for your team, without a ticket per tool.

The AI you wanted, with company knowledge behind it.

From a fresh AWS account to company-wide AI.

Discover

Deploy into your AWS account

Connect identity & SharePoint

Pilot one department

Roll out

About eCloudvalley

Where does our data live?

Can admins read our conversations?

Which models can we use?

What will it cost us to run?

How long does deployment take?

Does it work in Vietnamese?

See it running in your own AWS account.

Book a demo

Request received

Access you can explain.
Deny always wins.

Every AI dollar has an owner.
Known before the invoice.