Your Model, Your Key: BYOK and Model Choice
The security review is going fine until someone asks the inference question. Every investigation sends prompts, tool output and context to a model. Whose account runs that model? Which region serves it? Whose bill does it land on?
For a lot of teams the honest answer has to be "ours". They have a Bedrock commitment to burn down, an EU residency rule to respect, or a procurement team that wants model spend on the AWS invoice next to everything else.
That's why Frontier Investigation Agents can run on your own key. This post covers what Bring Your Own Key (BYOK) does, which models it runs, and what happens when your key fails at 3 a.m.
Model calls are part of your data path
An investigation agent is a heavy model user. One incident means many calls, each carrying the agent's system prompt, tool definitions, conversation history and retrieved context.
When those calls run on a platform's key, three things sit outside your control: where inference happens, which quota you hit, and how the spend shows up. For a pilot that's fine. For production, platform and security teams usually want all three back.
Why "just pick a model" isn't enough
The usual answer is a model dropdown. It solves the wrong half. You can choose the model, but it still runs on someone else's account, in someone else's region, against someone else's limits.
The other usual answer is self-hosting everything. That trades the problem for a bigger one: you now own the agent, the harness and the infrastructure under it. We wanted the narrow version. Keep the harness ours, move the model calls to you.
What BYOK does
BYOK runs the model calls behind agent responses on your own AWS Bedrock or Anthropic credentials instead of platform credits. The organization Owner sets it up once under Admin Settings → BYOK, and every workspace in the organization uses it.
01Provider
Bedrock or Anthropic
The organization Owner picks one under Admin Settings, BYOK.
02Credentials
Your key, your region
An IAM access key with a Bedrock region, or an Anthropic Console key.
03Models
One per row
Keep the defaults, change a row, or leave a row on CloudThinker credits.
04Verify
A test call per model
CloudThinker calls each model you picked before it saves the key.
It's available on the Scale, Scale+ and Enterprise plans. Only the Owner handles credentials. Admins and other members see the key status, not the key.
Model choice, row by row
You pick a model for six rows: the Light, Pro and Ultra chat modes, and the Review, Cyber and Resolve modules. CloudThinker sets a default for each.
01Light
Claude Haiku 4.5
The fast chat mode.
02Pro
Claude Sonnet 5
The balanced chat mode.
03Ultra
Claude Opus 5
Maximum reasoning for complex problems.
04Review
Claude Opus 5
Review conventions follow this row too.
05Cyber
Claude Opus 5
Cyber chat follows this row too.
06Resolve
Claude Sonnet 5
The incident module.
Any row can be set to CloudThinker credits, which runs it on the platform instead of your key. At least one row has to run on your key.
On Bedrock the list is longer than the defaults: Claude Opus 5.5, 5, 4.8, 4.7 and 4.6, Claude Sonnet 5 and 4.6, Claude Haiku 4.5, and five GPT models (GPT-6 Sol and Luna, GPT-5.6 Sol, Terra and Luna). An Anthropic key runs Claude Opus 5, Sonnet 5 and Haiku 4.5.
Model choice isn't cosmetic. On SREGym, swapping only the model inside Resolve moved the end-to-end resolution rate from 40% to 100% across seven models. How we read those results and pick defaults is its own post: Model-Agnostic by Design.
Where inference runs
On Bedrock, the Region you pick sets the inference profile:
- Global (recommended) uses the
global.profile, served from any commercial AWS region. - A US or Canada region uses
us., an EU regioneu., an Asia Pacific regionapac.. - South America (Sao Paulo) has no geographic profile, so it falls back to Global.
Two caveats from the docs. Claude Opus 4.6, 4.7, 4.8 and 5.5 and Claude Sonnet 4.6 aren't available with an Asia Pacific region, and the docs recommend Global there instead. And GPT models ignore the region entirely: GPT-6 always uses its Global profile, GPT-5.6 runs in a US region. If your data has to stay in the EU or Asia Pacific, don't pick a GPT model.
The IAM policy
For a Claude-only Bedrock key, the user needs three things: invoke on the Claude models, invoke on their inference profiles, and sts:GetSessionToken. This is the policy from the docs with the GPT statements removed, which the docs say to do when you pick no GPT model:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"bedrock:InvokeModel",
"bedrock:InvokeModelWithResponseStream"
],
"Resource": [
"arn:aws:bedrock:*::foundation-model/anthropic.claude-*",
"arn:aws:bedrock:*:*:inference-profile/*.anthropic.claude-*"
]
},
{
"Effect": "Allow",
"Action": ["sts:GetSessionToken"],
"Resource": "*"
}
]
}
The wildcard covers models CloudThinker adds later. If you want it tighter, list each model ID and each inference profile, such as us.anthropic.claude-opus-5.
When your key fails
A key that works on Monday can fail on Friday. Quotas run out, tokens expire, someone rotates a key and forgets the integration. We designed for that.
01Your key
Call runs on it
The turn shows a Your key badge and spends no credits.
02Retries
Still failing
CloudThinker retries a failed call before it gives up on your key.
03Fallback
Platform model
The call runs on platform credentials and spends platform credits.
04Rejected key
BYOK turns off
If the provider rejects the credentials, you get one notification and work moves to credits.
When a call on your key still fails after retries, CloudThinker runs it on a platform model with platform credentials. Those fallback calls spend credits.
When the provider rejects the credentials outright (an expired session token, a revoked key, access denied), CloudThinker turns BYOK off. You get one high-severity notification naming the provider's error code, and the key card shows Disabled after error. Agent work continues on credits until you rotate the key.
The decisions behind it
Fallback over failure. An investigation that stops halfway because a quota ran out is worse than one that finishes on a different account. The cost is that some calls leave your key, and we'd rather you know that than find out from a bill.
One key per organization, held by the Owner. Model credentials are closer to a billing instrument than a workspace setting. CloudThinker encrypts them at rest, and the browser never gets the saved secret back.
Visible per turn. A Your key badge marks every chat turn that ran on your key and spent no credits. You don't have to infer it from the invoice.
Same masking on every key. Before any call goes out, CloudThinker replaces known secrets and detected personal identifiers with placeholders. Your key doesn't change what the model sees. See What Never Reaches the Model.
Honest limits
- Two providers: AWS Bedrock and Anthropic. One is active at a time. To switch, you remove the key and connect the other.
- An Anthropic key runs three models. The wider list, including GPT, is Bedrock only.
- A temporary
ASIAkey can't be renewed, so rotate it before it expires. For a permanentAKIAkey, CloudThinker renews the session token itself. - Fallback calls run on platform credentials. If every call must stay on your account, plan quotas with that in mind.
- A model can be retired. The row then shows Model retired, pick another and you choose a replacement.
Try it
Connect the key, click Verify and activate, and wait for the card to show Active. Then run something real and look for the Your key badge:
"Investigate the latency alert on the checkout service from last night and show me the evidence for the root cause."
"Review the open merge request on the payments repo and flag anything that changes retry behaviour."
If you're weighing models for a row, run the same incident twice on two models and compare the verdicts. That's a small version of how we choose ours.
Start a trial or book a walkthrough.