Built with Mobileye’s cloud support team
The Problem
Machine learning teams frequently need special permissions on AWS SageMaker – raising parallel-instance limits or getting access to expensive GPU instance types. Uncontrolled access triggers unexpected cloud-cost spikes; blanket denials slow research. The trade-off needs contextual judgment, not a binary approval.
The Solution
The permissions agent evaluates each request by combining strict business rules with semantic text analysis:
- Instance-limit increases are executed directly, with an expiration date calculated from the requested duration and an automatic cost warning.
- Instance-type access is granted only when the user specifies a clear duration and explicit instance types. Overly broad requests are politely declined, with the rationale and a link to ML cost-optimization guidance.
- Multiple instance types are processed as individual actions, each with a full audit trail: ticket number, duration, date.
- Tickets are assigned to the right support engineer automatically.
How It Works in Practice
- The agent identifies a permission request in an incoming ticket.
- It checks whether the user specified an expiration and specific instance types rather than unrestricted access.
- If criteria are met, it executes the permission change with a reason field containing the ticket number for auditing.
- If information is missing or policy is violated, it asks for clarification or issues a reasoned refusal – without changing anything.
- It updates the ticket status while awaiting the user’s reply.
The Results
Legitimate requests are processed fast without losing financial control. Policy is enforced consistently, without engineers having to memorize the rules. Every permission change is documented with its justification and expiration date.
Why It’s Worth Talking About
An agent enforcing nuanced business policy rather than running scripts – evaluating context, politely refusing, and explaining its reasoning, around the clock.
