gcp-spend-guardrails

GCP Spend Guardrails (APPLY)

Overview

Per project, applies three blast-radius controls — but only when each is genuinely safe per the safety matrix in docs/superpowers/specs/2026-05-24-gcp-api-key-ironclad-skill-design.md §6. Actions that fail the safety gate are demoted to "flag for review" and surfaced for the human, never auto-applied.

When to Use

• Triggered by gcp-ironclad as Phase 3a, after the read-only audits.
• Or invoked standalone when you want only the spend-control half of the suite.

Inputs

• SESSION_DIR env var (must already contain audit.json and anomalies.json from prior phases when invoked by the driver).
• DRY_RUN env var: if 1, plan all actions but apply none. Default 0.
• QUOTA_FLOOR_PER_DAY env var: minimum daily request quota for Gemini API. Default 5000.
• QUOTA_MULTIPLIER env var: peak-multiplier for quota sizing. Default 5.

Outputs

Writes ${SESSION_DIR}/guardrails-applied.json matching output.schema.json.

Safety matrix (excerpt)

Action	Auto-apply ONLY when	Demoted to "flag" when
Set Gemini API quota	API enabled + ≥7d usage + proposed > peak	No usage data; new project (<7d); export missing
Quota sizing	max(peak_30d × 5, 5000/day)	Peak shows abuse signature → use floor only
Create budget alerts	caller is billing.admin + no existing budget at threshold	viewer-only; budget already configured
Recommend spend-cap budget	never auto-applied — console-only (no gcloud/API surface as of July 2026), and pausing a live service is a human call	always flagged, never applied
Disable idle API	zero 30-d usage + enabled >7d + not sys-*	any usage in 30d; enabled <7d; system project

Execution

Action 1 — Quota on generativelanguage.googleapis.com

For each project where generativelanguage.googleapis.com is enabled:

1. Read peak daily request count from the last 30 days via Monitoring API (same metric as the audit). If <7 days of data → skip with reason "insufficient_usage_data".
2. Compute target = max(peak * QUOTA_MULTIPLIER, QUOTA_FLOOR_PER_DAY).
3. Anti-abuse guard: if peak is itself a known abuse signature (e.g., the project appears in anomalies.json with multipleOver > 100), use QUOTA_FLOOR_PER_DAY instead of peak * QUOTA_MULTIPLIER.
4. Compare against current quota; if equal → outcome "skipped" with reason "already_at_target".
5. Otherwise (and not DRY_RUN), apply via:

   gcloud alpha services quota update \
     --consumer="projects/${P}" \
     --service="generativelanguage.googleapis.com" \
     --metric="generativelanguage.googleapis.com/generate_content_paid_requests" \
     --unit="1/d/{project}" \
     --override-value="${target}" \
     --force
   

   Rollback (record in details.rollback):

   gcloud alpha services quota update --consumer=projects/${P} --service=generativelanguage.googleapis.com --metric=... --unit=... --override-value=<previous>
   

6. If gcloud alpha services quota update is unavailable (alpha-surface drift), fall back to the REST API:

   curl -X POST \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     -H "Content-Type: application/json" \
     "https://serviceusage.googleapis.com/v1beta1/projects/${P}/services/generativelanguage.googleapis.com/consumerQuotaMetrics/.../limits/.../consumerOverrides" \
     -d "{\"overrideValue\":\"${target}\"}"