What SparkPilot does not do yet

An idle environment still bills while its EKS cluster exists. AWS lists $0.10 per cluster-hour in standard support and $0.60 in extended support. SparkPilot has no pause control; the only way to end that cluster charge is to delete the cluster. Worker capacity controls may reduce other charges. Other resources may still bill. SparkPilot's rate-card figure is an estimate.

Pre-dispatch iam:SimulatePrincipalPolicy checks cover EMR on EKS with BYOC-Lite onboarding. On EMR Serverless and EMR on EC2, preflight enforces policy and quota gates but does not simulate per-action IAM permissions before submit.

EMR on EKS is the end-to-end governed path today, with completed runs re-verified against AWS. EMR Serverless runs dispatch through the current control plane, with preflight, in a production workspace. EMR on EC2 can be created now; its engine-level provision, submit and in-flight cancel path passed once, on 2026-06-01, before the current dispatch architecture, and governed dispatch through the current control plane has not been proven there. Steady-state reconciliation on both engines has not been proven.

Team budgets can warn or block dispatch. A block prevents job submission, but existing AWS resources may still bill. The failure screen may attribute a budget block to environment setup.

Billed-truth reconciliation against your Cost and Usage Report — down to Split Cost Allocation Data on EKS — is built and has been exercised end to end against a simulated report; no billed run has yet been reconciled through a real CUR, and the production onboarding path is not yet reliable. It ships as early access until both are proven in production.

Cost-allocation tag propagation for Serverless is built, but the tag-to-CUR proof so far covers EMR on EKS only. Per-run billed attribution on Serverless is coming soon. On EMR on EC2, per-run billed attribution is not possible at all: EMR bills the cluster, and a step is not a billable resource.

Both private packages have been tested with stubs. A scheduler-driven run in a customer deployment remains unverified.

Failed dispatches have no dead-letter replay. Some infrastructure failures require resubmission.

Control Tower answers questions from authorized workspace evidence. Every change waits for approval, except routine work an admin lets it do without asking. Run diagnostics use rules.