Skip to content

Safety and Cost Safeguards

Jump to bottom
Anna edited this page Jun 25, 2026 · 1 revision

Safety & Cost Safeguards

Safe by default. No configuration required to be protected.

This page covers what you get out of the box, before touching any environment variables or flags. A developer running the server for the first time with zero configuration gets all three of these guarantees.

No Unexpected Bills

Short answer: running the server will not trigger paid GCP API charges beyond your project's normal quota consumption.

All 69 tools read from standard GCP APIs (Cloud Run, GKE, Pub/Sub, Monitoring, etc.). These calls are equivalent to what you'd make in the Cloud Console or with gcloud — they count against your existing project quota, not a per-call billing meter.

The one exception is Cloud Recommender, which is an optional paid API used to add efficiency signals to Aura Scores. It is disabled by default:

# Cloud Recommender is off unless you explicitly enable it
RECOMMENDER_ENABLED=false  # default — no action required

To enable it when you want the enhanced Aura Score signals:

RECOMMENDER_ENABLED=true GCP_PROJECT_ID=my-project ./aura-tracker-gcp

Note: enabling Cloud Recommender also requires the roles/recommender.viewer IAM role on the service account.

Rate Limiting as a Cost Ceiling

Every GCP API call is throttled at the server boundary — the LLM cannot generate traffic spikes that exhaust your quota.

Limit Value
Sustained rate 10 requests/second
Burst capacity 20 requests
Per-call timeout 30 seconds

These limits are enforced regardless of how fast the LLM sends tool calls.

Read-Only by Default

67 of 69 tools are pure reads. The only tools that can change GCP state are:

Tool What it changes
gcp_gke_scale_deployment GKE node pool size
gcp_cloudrun_update_traffic Cloud Run traffic split percentages

Both require a two-step human confirmation before executing (see below).

Additional Read-Only Guarantees

  • Secret Manager: only secret metadata (name, labels, create time) is returned. Secret values are never fetched.
  • GKE Workloads: secret references in pod environment variables are masked in the response before the LLM sees them.
  • No external calls: the server makes no outbound requests except to GCP service endpoints.
  • No data persistence: results flow directly from GCP to your LLM. Nothing is stored outside your environment.

Human-in-the-Loop: Mutation Confirmation

The two mutation tools above are protected by a mandatory two-step confirmation flow enforced at the server level. The LLM cannot bypass it.

Step 1 — Preview (no GCP call made)
──────────────────────────────────────────────────────
  You ask the LLM: "Scale the api-gateway node pool to 5 nodes"
        ↓
  LLM calls tool with dry_run=true
        ↓
  Server generates a plan: what would change, current state vs. desired
  Returns: plan_id + human-readable preview + 10-minute expiry
        ↓
  LLM presents the preview to YOU
        ↓
  ★ YOU decide: approve or reject ★

Step 2 — Execute (only after your explicit approval)
──────────────────────────────────────────────────────
  You say: "Yes, proceed"
        ↓
  LLM calls tool with confirm_plan_id=<plan_id>
        ↓
  Server validates: plan exists, not expired, not already used
  Atomically consumes the plan (single-use — prevents replay)
  Executes the mutation against GCP
  Logs the confirmation with full audit context

Key safety properties of this flow:

  • Plans expire after 10 minutes. A stale plan_id is rejected.
  • Each plan_id is single-use — consumed on confirmation, so it cannot be replayed.
  • Both the dry-run and the confirmation are logged with project, resource, and previous state.
  • If current state already matches desired state, the tool returns no_change_needed: true without executing anything.

Disabling the Confirmation Gate (Development Only)

SAFETY_ENABLED=false GCP_PROJECT_ID=my-project ./aura-tracker-gcp

The server logs a WARNING on startup when SAFETY_ENABLED=false. Do not use in production.

Default Settings Summary

Feature Default How to change
Cloud Recommender (paid API) ❌ Disabled RECOMMENDER_ENABLED=true
PII / credential scrubbing ❌ Disabled ANONYMIZE_ENABLED=true
Mutation confirmation gate (HITL) ✅ Enabled SAFETY_ENABLED=false (dev only)
Secret Manager value reads ❌ Never Not configurable

IAM Least Privilege

Run the server with a dedicated service account that has only the roles it needs — not roles/owner or roles/editor.

See Security and Safety for the complete role list and the scripts/setup-iam.sh one-liner that creates and configures the service account for you.

Quick check: ask the LLM to verify your permissions before relying on the server:

Test my IAM permissions for project my-project

This calls gcp_iam_test_permissions and returns a per-permission allowed: true/false result for every GCP API the server needs.

What Aura Tracker GCP Never Does

Never Why
Reads Secret Manager values Only secret metadata (name, labels, create time) is fetched
Stores data externally Results flow directly from GCP to your LLM; nothing is persisted
Executes mutations without a confirmed plan_id Enforced at the port boundary in internal/safety/decorator.go
Initializes unused GCP clients Only clients needed for enabled --modules are instantiated
Contacts any endpoint outside GCP APIs No outbound calls except to GCP service endpoints

Next Steps

Clone this wiki locally