Agent security advanced protection billing rules, limited-time free notice, service authorization, and billing examples. After formal billing starts, a postpaid model applies, consisting of the defense seat fee and excess Credits usage.
As of September 2026, Agent security advanced protection is still in a limited-time free stage. The platform will give at least one month's notice before formal charging begins, and billing will follow the rules below after that.
Pricing
After formal billing starts, advanced protection adopts a postpaid model combining "hourly billing for running seats + daily default Credit quota + excess Credit billing".
| Billing Item | Unit Price | Billing Method |
|---|---|---|
| Agent Defense Seat Fee | ¥0.42 / seat·hour | Billed by the number of Agent seats running under advanced protection and their duration |
| Excess Credits Usage | ¥0.0015 / Credit | The portion exceeding the daily default Credit quota, billed by actual usage |
Credit Quota and Consumption
| Item | Description |
|---|---|
| Default quota | 300 Credits per seat per day |
| Quota isolation | Each Agent has an independent quota that cannot be shared across Agents |
| Validity period | Credits are valid for 24 hours (calculated by calendar day) and do not carry over after expiration |
| Consumption rule | Credit consumption is related to the volume of content inspected. The system converts Credits based on the token count of the inspected content — the longer the content, the more Credits consumed. Actual consumption is subject to console and billing records |
Service Authorization
When activating advanced protection, the system will automatically create the following service-linked roles to complete the activation of the Agent Security Center and enable security detection capabilities.
| Role Name | Description |
|---|---|
| AliyunServiceRoleForSFMSecurity | Initiated by Bailian to activate and access the Agent Security Center, and call security detection and defense capabilities |
| AliyunServiceRoleForSas | Service-linked role for AI Security Center (AI Security Center) to access resources in other cloud products |
| AliyunServiceRoleForSasCspm | Service-linked role for Cloud Security Center multi-account management (sas-rd) |
| AliyunServiceRoleForSasAI | Service-linked role for Cloud Security Center CSPM (sas-cspm) |
| AliyunServiceRoleForEiam | Service-linked role for Cloud Security Center (sas) |
Before activation, you must read and agree to the "Bailian Agent Security (Pay-As-You-Go) Service Agreement" and "Bailian Security Service-Linked Role Authorization." Clicking confirm indicates that you acknowledge and agree to the agreements and authorization operations.
Billing Example
Scenario: 3 Agents under the account have advanced protection enabled, all running for 24 hours; security detection consumes a total of 10,000 Credits during this period.
| Billing Item | Calculation | Amount |
|---|---|---|
| Agent Defense Seat Fee | 3 seats × 24 hours × ¥0.42/seat·hour | ¥30.24 |
| Daily default quota | 3 seats × 300 Credits | 900 Credits (free) |
| Excess Credits Usage | (10,000 - 900) Credits × ¥0.0015/Credit | ¥13.65 |
| Daily Total | ¥43.89 |
Activation Process
- Click Security in the console navigation bar, then select Advanced Protection > Security Policy from the left menu.
- Click the Activate Now button on the page to open the activation confirmation dialog.
- Review the pricing and billing items, and confirm the service authorization details.
- Check "I have read and agree" to the relevant agreements.
- Click Confirm Activation. The system will automatically create the service-linked roles and complete activation.
Six security policies are enabled by default upon activation. The content security policy must be enabled manually after activation. To adjust security policies, click "Go to Security Configuration" on the Security Policy page.
Default Protection vs. Advanced Protection
| Protection Type | Cost | Capabilities | Activation |
|---|---|---|---|
| Default Protection | Free | Agent identity issuance, content security, supply chain static scan, credential isolation, session lifecycle governance | Automatically enabled as Agents are used, no activation required |
| Advanced Protection | Free for a limited time (pay-as-you-go after formal billing) | 7 security policy configurations, risk monitoring, and risk and audit | Requires service authorization and activation on the Security Policy page |
Related Pages
- Security Policy: Enable advanced protection policies on demand
- Protection Overview: View protection panorama and interception statistics