An overspend guardrail stops runaway infrastructure before it is applied. The Cost Policy Guardrail Generator emits a checklist, a Terraform check block and an OPA Rego policy from a simple form, so you can gate plans on estimated monthly cost without writing policy by hand. The three outputs describe the same rule in different formats: a human checklist, a native Terraform check that fails a plan, and a Rego policy you can run in Conftest or OPA during CI.
Set a monthly budget, an alert threshold and an enforcement mode (deny or warn), then optionally cap individual resource types. The deny mode hard-blocks an apply that would exceed the budget, while warn mode surfaces the violation without blocking, which is useful while you tune budgets. The output combines a Terraform check block with an OPA Rego policy that reads an estimate such as Infracost output or a Terraform variable.
Input is validated and errors are reported inline, for example when the budget is not positive or the threshold is outside one to one hundred percent. Everything runs locally with nothing uploaded, so your budget numbers and resource topology never leave the browser. Use the generated pieces as a starting point, then wire the estimate into your pre-apply step.
The guardrail also documents intent. The generated checklist is something you can paste into a pull request description or a runbook so reviewers see the cost rules that apply to the change, not just the policy code. That shared context makes budget conversations happen earlier and with less friction, because the limit and its threshold are stated in plain language next to the infrastructure.
Adopting a guardrail early changes behaviour. When engineers know a plan will fail above a budget, they right-size instances, drop unused disks and question expensive defaults during authoring rather than after the bill arrives. The tool makes that feedback loop cheap to set up, which is the point: a small, clear rule that runs everywhere is better than a perfect policy nobody wires in.