AIATS Insights
Technical notes, implementation lessons and production playbooks for ServiceNow, AWS and enterprise AI.
On 8 Sep 2026 AWS let API Gateway REST APIs present an ACM (or Private CA) client certificate to backends for mutual TLS — replacing the old self-signed outbound cert. UK zero-trust playbook for FS/healthcare PKI, stage config and CAB evidence.
AI Control Tower Aug/Sep 2026 ships a Kill Switch that revokes agent credentials across Okta, GCP and AWS Bedrock and stops agents at runtime — cutting mean time to contain from ~30 minutes to seconds. UK CISO playbook before you treat it as production IR.
AgentCore Gateway Runtime targets are GA: path-routed passthrough to Runtime agents with policy, Guardrails, buffered interceptors and hard bypass locks (SigV4 SourceArn or JWT workload allowlist). UK gate before you expose the runtime ARN.
Australia / Zurich P11+ Dynamic IRE auto-scores Hardware CI identity and can arrive committed on zBoot. UK playbook: simulate on non-prod, review cmdb_ire_output_comparison_item parity, exclude custom classes, then CAB-commit — with Change to IRE rollback.
AWS MCP Server (4 Sep 2026) lets coding agents diagnose Lambda plus API Gateway, EventBridge, S3, DynamoDB, SNS, SQS and Step Functions — with 7-day baselines and fewer tokens. UK playbook: eu-central-1 MCP preference, IAM least privilege, PII in logs and SRE runbook gates.
From 9 Jul 2026, OOTB Now Assist / Otto skills switch to third-party model defaults with each store app update. UK estates need an AI Control Tower allowed-provider gate, CAB dual-run evidence and a Now LLM retirement plan — before Assists look fine and skills are blocked.
From 9 Sep 2026, Lambda Managed Instances support up to 90-minute async/ESM timeouts (6x prior 15-minute limit). UK playbook: eu-west-1/2, clean stop, idempotency and when to keep sync at 15 minutes.
September 2026 reimagines AI Agent Studio with guided build, Advisor and side-by-side test. UK gate: Zurich P13+/Otto 9.0.8+, CAB, GDPR, sn_aia.admin, Prime/Pro Plus and human-in-the-loop.
Agent Registry GA moved to the agent-registry namespace; bedrock-agentcore registry APIs shut on 17 Sep 2026. UK SRE cutover: endpoints, IAM, schema, migration tooling — with ~2 days left.
Knowledge 2026 puts the L1 Service Desk AI Specialist into the Autonomous Workforce. UK ITSM playbook: password resets to VPN, CAB, IR35/ops, CMDB, GDPR and human-in-the-loop before autonomy.
AgentCore Policy is GA (Mar 2026) with Cedar at the Gateway and Dogwood temporal rules for session trajectory. UK playbook: LOG_ONLY → ENFORCE, session IDs and high-risk tool gates.
Zurich put Vault Console and Machine Identity Console beside agentic AI. UK CISOs need a native control playbook — encryption, NHI hygiene and Zero Trust — not another bolt-on slide.