Sign in to AI Platform Observability

PayCargo identity required. Authenticator app TOTP code required.

Once SSO federation is enabled: Sign in with PayCargo SSO →
Demo modal. No real backend. Click Sign in to dismiss and explore the dashboard. In production, this flow goes through Cognito with TOTP MFA required. SSO federation lights up in Phase 2.
AI Platform Observability
obs.ai-sandbox.paycargo.com
CLICK-THROUGH PROTOTYPE
mtang@paycargo.com MT
Hover over any panel to see the AWS API call behind it, the cost per query, and which Step.N.html doc explains the underlying resource.
Operators operators · operations · the external developer
Executive CTO · VP Eng · CEO · CISO · strategic leadership
Audit SecOps · Compliance · Auditors
Live · auto-refresh every 60s

Bedrock invocations (1h)

LIVE
142calls
vs 138 prev hour
↑ 2.9%
AWS API call
cloudwatch:GetMetricData
Namespace=AWS/Bedrock
MetricName=Invocations
Cost per query
$0.00001 (1 metric)
Where deployed
Step.4.html § Observability

NFW packets

ALERT MODE
2.1kaccept
0 dropped (alert mode — flip in Step 5)
— No drops yet
AWS API call
cloudwatch:GetMetricData
Namespace=AWS/NetworkFirewall
AcceptedPackets + DroppedPackets
Cost per query
$0.00002 (2 metrics)
Where deployed
Step.3.html § Network Firewall

Lambda errors (24h)

OK
3errors
across 12 functions, 0 throttles
↓ 6 from yesterday
AWS API call
cloudwatch:GetMetricData
Namespace=AWS/Lambda
Errors + Throttles, all functions
Cost per query
~$0.0001 (12 functions × 2 metrics)
Where deployed
Step.4.html § Lambda tools

State backend health

SYNC
2sage
DDB lock free · S3 state fresh
Last apply: 16:45 (CI)
AWS API call
dynamodb:DescribeTable
+ s3:HeadObject (state file)
Cost per query
~$0.0000005 (essentially free)
Where deployed
Step.1.html § Bootstrap state backend

Recent NFW alert log entries (last 50)

Time Source Dest FQDN (TLS SNI) Action Match rule
16:42:18 10.0.4.137 (agent-1b) api.salesforce.com alert sor-allowlist
16:38:51 10.0.0.42 (agent-1a) api.salesforce.com alert sor-allowlist
16:35:09 10.0.4.137 (agent-1b) api.monday.com alert sor-allowlist
15:22:34 10.0.8.91 (agent-1c) api.gitbook.com alert sor-allowlist

Daily Narrative

Generated 2026-05-28 09:00 ET · Claude Haiku 4.5 · 612 tokens

Yesterday the AI platform processed 1,247 agent invocations across 2 active tiers, returning 542k output tokens at a measured cost of $4.31. Activity was steady through the day with a peak around 14:00 ET coinciding with weekly Sales report generation.

Three notable events: (1) one NFW alert fired against api.example-test.com at 11:34, investigated and confirmed as a the external developer integration test from a documented sandbox flow; (2) GuardDuty reported one Low-severity finding regarding console-MFA-disabled, which applies to AWS Identity Center and is by design (Identity Center handles MFA at its layer, not at the AWS console layer); (3) the daily backup of the agent state table completed in 11 seconds. No PII workflows were exercised. No deploys.

📜 Guardrail applied: ai-sandbox-default 🔒 Encrypted with audit CMK Source data: 24h CloudWatch + Cost Explorer aggregation

Agent activity (30 days)

DAILY
38.2kinvocations
average 1,273/day · trend ↑ steady
AWS API call
cloudwatch:GetMetricData
Namespace=AWS/Bedrock
Period=86400s · 30 datapoints
Cost per query
$0.00003 (30 datapoints)
Where deployed
Step.4.html § Observability

Month-to-date AWS spend

~62% of plan
$287.42
of ~$464/mo projected baseline
28 days into May · pacing on target
AWS API call
ce:GetCostAndUsage
Granularity=DAILY
Group by service
Cost per query
$0.01 (most expensive call in this app)
Where deployed
/MODULES.md § Inventory

GuardDuty findings (sev ≥ 4)

0 HIGH
0high · 1 med
Last 7 days · all triaged
AWS API call
guardduty:ListFindings
Filter: severity >= 4
Cost per query
~$0 (within free request tier)
Where deployed
Step.4.html § Observability

Last successful deploy

CI
substrate/finish-step-4
2026-05-28 16:45 ET · 0 add, 3 chg, 0 del
Approver: mtang@paycargo.com
Source
github API: workflow runs
filter conclusion=success
Cost per query
$0 (GitHub API, free)
Where deployed
Step.3a.html § CI wiring

Audit retention

WORM
7yrcompliance
Object Lock COMPLIANCE · 2555 days
Cannot be deleted even by root
AWS API call
s3:GetObjectLockConfiguration
bucket=ai-sandbox-audit-959228203854
Cost per query
$0 (free GET)
Where deployed
Step.4.html § Data module

Recent role assumptions (CloudTrail AssumeRole events)

Time UTC
Principal
Role assumed
Action
22:53:46
repo:PayCargoDevOps/ai-sandbox:ref:main
ai-sandbox-github-actions-deploy (gha-apply-26608748921)
↗ Open
22:43:53
repo:PayCargoDevOps/ai-sandbox:pull_request
ai-sandbox-github-actions-deploy (gha-plan-26606647811)
↗ Open
21:30:12
mtang@paycargo.com (SSO)
AWSReservedSSO_AdministratorAccess
↗ Open
20:15:44
mtang@paycargo.com (SSO)
AWSReservedSSO_AdministratorAccess
↗ Open

KMS Decrypt events (any agent decrypting lockbox = appears here)

Time Principal Key
16:42:18 cloudtrail.amazonaws.com audit CMK
16:38:51 bedrock.amazonaws.com agent CMK
16:35:09 logs.amazonaws.com audit CMK
✓ Zero agent-role-as-principal entries. PII-blindness holding.

Pre-built Logs Insights queries (click to open in CloudWatch)

↗ Recent failed sign-ins (Cognito)
↗ Agent invocations grouped by tier
↗ Permission boundary denies (last 24h)
↗ NFW alert frequency by destination
↗ All KMS Decrypt + Encrypt by principal
↗ DDB writes to lockbox table (should be 0 in Phase 1)