# Accounts & spending guardrails

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/account-guardrails

Lock every account the product depends on with a second factor and cap what a mistake can cost before strangers arrive.

Usually comes after: [Secrets management](https://gradus.kazet.blog/tree/cloud-application/step/secrets-management).

## Prompt for your AI assistant

```
List every account this product now depends on: the cloud provider, the code host, the domain registrar, the DNS host, the CI service and every other provider in docs/decisions. For each, ask me to turn on two-factor authentication with an app or a security key rather than SMS, keep the recovery codes away from that device and remove every person and key that no longer needs access. Ask me to set a monthly budget on the cloud billing account with alerts at half, all and more than all of it, sent to an address I read, and check that every running service has a maximum instance count. Write the list of accounts, who can reach each one and where the recovery codes live, never the codes themselves, into docs/runbooks/accounts.md.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt