Models

The Models page shows how the agent connects to AI models and which models it uses. There are two pricing modes, platform models and Bring Your Own Model, and with BYOM you choose which connection method is active.

Platform models (default)

By default, your enterprise uses platform-managed models. Model selection and API keys are handled automatically by Infracodebase. You pay based on consumption and don't need to configure anything. This is the simplest option for getting started.

Bring Your Own Model

If you need more control, you can opt into Bring Your Own Model (BYOM). This moves you from consumption-based pricing to negotiated enterprise pricing, where costs are passed through based on your own agreement. Models run on your own credentials, not platform credits.

BYOM offers three connection methods. You configure any of them independently, then select one as the active method. The active method is what the agent uses; configuring or saving a method that isn't active never changes what's live, and selecting a configured method switches to it.

Anthropic API key: connect directly to Anthropic with your own key.
Custom proxy: route through your own gateway or an Anthropic-compatible endpoint.
AWS Bedrock: invoke Claude in your own AWS account over a short-lived cross-account IAM role, with no keys stored.

To enable BYOM, contact us for enterprise pricing. Once enabled, configure it from the Models settings page. You can also set an optional monthly spend cap to block new agent sessions once your team's API spend reaches a limit.

Anthropic API key

Provide your own Anthropic API key to authenticate directly. This lets you take advantage of your organization's existing enterprise contract with Anthropic, including negotiated rates, legal terms, and usage agreements. Choose which models the agent uses in Model Assignments.

Custom proxy

For organizations that need to route traffic through their own infrastructure, point the agent at your own Anthropic-compatible endpoint instead of connecting directly to Anthropic. This is useful when your company requires traffic to flow through internal infrastructure, you have logging, compliance, or security layers in front of Anthropic, or you need custom authentication headers.

Configure a custom proxy by providing a base URL (must be HTTPS) and optionally adding custom headers for authentication.

AWS Bedrock

AWS Bedrock lets Infracodebase invoke Claude in your AWS account using short-lived, role-assumed credentials. No long-lived keys are ever stored. You create one IAM role in your account that Infracodebase can assume, and Infracodebase signs each request with temporary credentials scoped to that role.

Everything you need is shown on the Models page under the AWS Bedrock method.

1. Get your setup values. Choose AWS Bedrock on the Models page and click Generate External ID (Infracodebase assigns it; you never choose or type it). The page then shows everything your role needs:

The shared secret (External ID) you just generated. It links your role to Infracodebase so no one else can assume it.
The caller identity, the Infracodebase IAM role ARN that will assume your role.
Your organization check, the Infracodebase AWS Org ID.
A pre-filled trust policy that combines all of the above. Use the Copy button; it copies the real values even when the External ID is masked on screen. Generate the External ID first, or the policy will contain a placeholder instead of your secret.

2. Create the IAM role in AWS. Create a role that trusts Infracodebase and can invoke Bedrock.

In the AWS console:

Go to IAM Roles Create role Custom trust policy.
Paste the trust policy copied from the Models page, then click Next.
On Add permissions, search for Bedrock, select the AWS-managed AmazonBedrockFullAccess, then click Next.
Name the role (for example infracodebase-bedrock) and click Create role.
Copy the role's ARN from its summary page.

Optionally, for least privilege, attach a custom policy with only the invoke actions instead of AmazonBedrockFullAccess. On the Add permissions step, click Create policy, open the JSON tab, and paste:

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": "*"
    }
  ]
}

Or with the AWS CLI. Save the copied trust policy to trust-policy.json, then:

bash

aws iam create-role \
  --role-name infracodebase-bedrock \
  --assume-role-policy-document file://trust-policy.json

aws iam put-role-policy \
  --role-name infracodebase-bedrock \
  --policy-name bedrock-invoke \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": "*"
    }]
  }'

# The ARN to paste back into Infracodebase:
aws iam get-role --role-name infracodebase-bedrock --query Role.Arn --output text

3. Return the details. Back on the Models page, paste your Bedrock role ARN and the region your Bedrock models run in. Optionally set the CloudTrail identity label under Advanced (the default works for everyone). Save, and the agent switches to AWS Bedrock.

Model IDs for Bedrock are your account's own Bedrock model IDs or inference-profile IDs (for example us.anthropic.claude-sonnet-4-5-...), not Anthropic's model names. Enter them in Model Assignments once Bedrock is active.

Rotating the External ID. You can regenerate the External ID from the Models page. If you do, update the sts:ExternalId value in your role's trust policy in AWS, or role assumption will start failing.

Model assignments

Choose which model the agent uses for each feature. On platform models, more capable models consume credits faster. With BYOM, model IDs run on your own credentials: for Anthropic direct and proxy they are Anthropic model names; for Bedrock they are your account's Bedrock model or inference-profile IDs.