When a developer uses an AI coding assistant, that request goes to a model somewhere. For most organizations, “somewhere” means a vendor’s cloud, which operates under that vendor’s terms, outside the security boundary the organization has spent years building. For regulated industries and government agencies, that can be the specific factor standing between an approved AI program and one that stays stalled indefinitely.

Jamf for Mac with AI Governance and Amazon Bedrock work together to address that. The way they fit together answers a question a lot of IT and security teams are currently stuck on: How do we let employees use AI tools without our data going to someone else's cloud?

AI Governance is a new capability available in Jamf for Mac and it is included at no additional cost for existing and new customers.

The Setup

AI applications like Claude Code, Claude Desktop, and OpenAI Codex run locally on a user’s device. Each one reads local configuration files that define things like which inference provider to authenticate against, which additional services to connect to, and how activity is logged.

Governing these applications at enterprise scale means controlling both where the inference runs and how each application is configured. 

Amazon Bedrock covers the first part by providing model inference through your own AWS account, running in the AWS Regions you select. The inference stays inside your AWS security boundary rather than routing to a vendor’s general-purpose cloud service. 

Jamf for Mac covers the second part by defining the settings that connect each application to Amazon Bedrock, and then delivering them across the fleet through the same native path already in use for other device policies, Declarative Device Management. 

Together, these set up an organization to say “yes” to AI tools, while being able to keep both the inference and the configuration under its own control. 

How It Works in Practice

The workflow has three parts designed to be completed in a single session. 

Part One: Creating the Policy

In Jamf for Mac, under AI Governance, the policy builder handles the Amazon Bedrock provider settings, including your authentication method, AWS Region, and model access. From there, you can configure how the application behaves, covering things like effort levels, which additional services it can connect to, local folder permissions, sandbox settings, and telemetry. 

For anyone watching cloud AI spend, enabling prompt caching directly in the policy helps immensely. AWS reports that in iterative coding workflows, prompt caching can reduce costs by up to 90 percent and latency by up to 85 percent for supported models. That is a meaningful number for teams whose AI budget is growing at a faster rate than they projected. 

Part Two: Deploying through Blueprints

The policy deploys to your target groups through Jamf Blueprints and is delivered as managed configuration through Declarative Device Management. The configuration is on the device before the user opens the application, so an employee can open the tool and start working without manual setup, a file to edit, or a support ticket to enter.

Part Three: Validating and Monitoring

After deployment, Jamf shows policy scope and deployment status. AI Visibility surfaces AI applications and activity across the fleet. Reports can be generated from there for governance evidence. 

Why the Architecture Matters

The configuration being delivered through Declarative Device Management sets up the managed settings to be resistant to local changes. Apple devices have an advantage for governing AI because macOS includes a management framework that allows IT to set configuration directly on the device wirelessly. These settings aren’t easily changed locally, which is exactly what AI governance needs. This is the reason the Jamf for Mac approach to AI Governance produces evidence an auditor will accept instead of a policy document that only describes intent. 

With inference running through your own AWS account in Regions you select, questions about data residency and security boundaries have concrete answers. This is a key deciding factor for organizations in regulated industries or agencies with specific requirements about where workloads run. 

Overall, with this architecture, everything deploys through the management plane already running your device fleet. There’s no new infrastructure to stand up and no new console your team has to learn. 

Who This Is For

This pairing makes the most sense for organizations that have already decided AI is happening and want to make sure it is implemented properly at their organization. Usually, that means engineering teams who are asking for AI coding tools, security teams that need policy enforcement and an audit trail, and finance teams watching a cloud AI line item that is difficult to forecast. 

It’s also a good fit for organizations that already have AWS. If your infrastructure already runs on AWS, keeping AI inference in the same account and Regions is a smaller step than introducing a separate vendor relationship. 

Getting Started

There are prerequisites to complete on the Jamf side before building a first policy, and the right Amazon Bedrock model access needs to be in place on the AWS side. Both of these go faster with someone who has done it before. 

MBS works with organizations to scope what they need, get the prerequisites sorted, and build a first policy that reflects how their teams actually work. If you’re trying to figure out how to enable AI without giving up control of it, reach out and we’ll walk through what this could look like in your environment. 

Contact Us

Mac Business Solutions is a certified Apple and Jamf partner specializing in enterprise Apple device management, lifecycle services, and IT infrastructure for commercial and federal clients.
Apple, the Apple logo, macOS, and Mac are trademarks of Apple Inc., registered in the U.S. and other countries and regions.