Stops off-hours resources, runs FinOps playbooks, closes exposure on AWS, Azure and GCP, and governs AI spend. You grant the write role. Every playbook and remediation goes through approval, grace, and an audit trail.
Business plan. Write is optional and separate from read. Posture on AWS, Azure and GCP.
Example
Detect
vol-08c3
Unattached EBS volume · 34 days
Environment=staging
Propose
Approve
AAA Sentinel · approval queue
Delete this volume?
Execute
Applied on AWS. The re-scan no longer flags the finding.
Only actions with a real executor. FinOps and posture on AWS, Azure and GCP; spend controls where the AI vendor exposes an API.
Cleanup and schedules on all three clouds, with the write role you deploy.
Posture remediations with approval, on AWS, Azure and GCP. After apply, the agent re-reads the resource to confirm the finding is closed.
Where the vendor exposes a write API. Otherwise the product leaves a manual guide.
Nightly shutdown is not a playbook: it is a schedule. Once set, the agent stops and starts by your days, timezone and tags. You do not approve every night.
Exact stop and start hours. Example: stop at 20:00 and start at 08:00.
Weekdays only, or the calendar you define.
UTC, Europe/Madrid, America/New_York… the agent converts for you.
Apply the schedule to Environment=staging, Team=backend or other tags.
dev-staging-off
Example
Stop
20:00
Start
08:00
Active days
Filter: Environment in dev or staging. Cloud: AWS, Azure or GCP.
Five real templates. Each one fires on scan, filters resources and queues the action with grace. Nightly stop lives under Schedules, not here.
old-snapshots-cleanup
Proposes deleting snapshots older than 90 days.
Action: delete_snapshot · Grace: 48 hours
unused-volumes-cleanup
Proposes deleting volumes unattached for more than 30 days.
Action: delete_volume · Grace: 48 hours
idle-eip-release
Proposes releasing unassociated Elastic IPs.
Action: release_eip · Grace: 24 hours
auto-tagging
Applies governance tags to resources missing Environment.
Action: apply_tags · Grace: No grace
copilot-inactive-seat-cleanup
Proposes revoking GitHub Copilot seats with no activity in 30 days.
Action: revoke_seat · Grace: 48 hours
Playbooks and remediations enter a queue. The team approves or rejects. A proposal nobody answers expires after 7 days, and an approved one can still be cancelled during the grace period.
If nobody approves or rejects, the action cancels on its own.
Approve or reject without opening the console.
If the primary approver is silent, it moves to the next teammate.
Owner, Admin and Approver approve. Viewer only sees history.
Approval queue
Example
Delete old snapshots
PendingPlaybook old-snapshots-cleanup
19 h left
Close SSH open to the internet
PendingRemediation restrict_sg_admin_ingress · AWS
6 h left
Revoke Copilot seats
ApprovedPlaybook copilot-inactive-seat-cleanup
Queued to run
Each executor uses the native API with credentials you grant. No resident agent in your account.
Posture on AWS, Azure and GCP: open admin, public storage or SQL, and encryption. Anthropic only revokes keys: its console API does not expose spend alerts or limits. Cursor only sets the per-user limit.
The read role does not write. The write role is voluntary, scoped to these actions, and you can revoke it.
Independent from read. You grant it and you revoke it.
They are not applied in silence. A schedule, once created, does run on its own.
Who proposed, who approved, when, and the result. Kept for one year.
Business from €249/month. Includes the agent, 20 accounts and 50 members. The security add-on is extra if you want posture and these remediations.
Start BusinessNo credit card · Free trial · Cancel anytime
