Fortune 500 Chipmaker Blocks Untrusted AI Models Across Every AWS Account
A Fortune 500 semiconductor company used Native to block an untrusted foundation model in every AWS account and region while keeping Amazon Bedrock open for approved use. The control went live in 3 business days instead of 3 months.
Challenge
The company wanted its teams to build with Amazon Bedrock, but needed to keep one specific untrusted model, DeepSeek, out of the organization entirely. An allowlist would have meant re-approving every new model as it shipped, a maintenance tax that slows adoption. Doing it by hand across every account and region in a large, multi-account AWS environment wasn't realistic.
Solution
Native's managed AI model policy supports both allowlist and denylist semantics, enforced as service control policies and resource control policies across every AWS account and region from one place. The company uses the denylist to block DeepSeek org-wide while leaving approved Bedrock models available. Unapproved InvokeModel attempts show up in Native's blocked-actions view, sourced from AWS CloudTrail, with drill-down by identity. Native also simulates the impact before enforcement, so a model policy doesn't break legitimate Bedrock use the way an all-or-nothing control can. The team's reaction when they saw the deny capability: "That definitely reduces the overhead and makes life easier."
AWS services: Amazon Bedrock, AWS Organizations (SCPs, RCPs), AWS IAM, AWS CloudTrail.
Results and Outcomes
- Control implementation in 3 business days, down from about three months without Native.
- 100% of AWS accounts covered by the control, measured through Native's coverage dashboard.
- When AWS changed how Bedrock handles cross-region inference, Native shipped a policy update the company rolled out across its estate with one click.
- Approved exceptions for specific business units, with more granular policies on Bedrock features in progress.
- In production since August 2025.