Ask the Cost Optimizer

When you submit a question, the browser gets a reCAPTCHA v3 token silently in the background and sends it with the request. If you arrived via a VIP link, the token is used instead — skipping reCAPTCHA entirely.

The request hits API Gateway, which enforces per-IP rate limits before routing to the chat Lambda. The Lambda checks an SSM parameter that acts as a budget circuit breaker — if monthly spend on the public lane exceeds the threshold, it returns 429 without calling Bedrock.

If the last scan data is older than the configured threshold (default 7 days), the Lambda fires an async invoke to the scan Lambda — fire-and-forget, so it doesn't delay your answer.

Every prompt passes through Bedrock Guardrails before reaching Claude — content filtering for harmful content and prompt injection detection at high sensitivity.

The prompt is passed to Claude Haiku on Bedrock with three tools attached: get_summary, get_findings, and get_report. Claude decides which to call, reads from DynamoDB and S3, and reasons over the real scan data before writing an answer. Tool calls are capped at three rounds to keep latency predictable.

The full answer is returned as JSON and rendered in the page. No data is stored client-side. Each request is logged with lane, token counts, tool calls, and duration for observability.