User Guide
This guide gives a tour of what you can do once 0scp is deployed and ACTIVE.
Detect → Contain
Section titled “Detect → Contain”0scp continuously evaluates Organization activity against your policy set. When a rule matches a risky action, it can contain the principal automatically using a pluggable strategy:
- Org SCP — attach a restrictive Service Control Policy (Organization mode).
- IAM deny — attach an inline deny (standalone mode).
- Key deactivation — disable offending access keys.
Policies are code-defined and can go beyond raw SCPs using the 0scp DSL.
Cost budgets
Section titled “Cost budgets”Set per-user and per-group spend budgets — for example, “this team gets 30% of the account.” Budgets can notify, report, or enforce by blocking over-budget principals (reusing the same containment engine).
Attack-graph
Section titled “Attack-graph”A live graph of principals, resources, and cross-account relationships. Use it to understand blast radius before you change a policy and to trace multi-hop access paths.
AI autopilot (opt-in)
Section titled “AI autopilot (opt-in)”An optional Amazon Bedrock assistant that analyzes platform data, explains findings, and can propose or auto-enforce guardrails. It reuses the containment and budgets engines, so anything it does, you can do by hand — and audit.
Where to do these things
Section titled “Where to do these things”| Surface | Use it for |
|---|---|
Customer Portal (/app) | License status, plan, deploy link. |
| In-account console / MCP tools | Policies, budgets, graph, autopilot. |
| Reports & dashboards | Read-only views (always available). |
See Support for help and Licensing for what each entitlement state unlocks.