AIATS Insights · Topic
Zero trust, identity, agent containment and security controls.
AWS's 21 Sep 2026 pattern turns Bedrock Guardrails interventions into OCSF Detection Findings in the CloudWatch unified data store. A UK SOC/SRE gate: transform locally, centralize sanitized findings, correlate with CloudTrail and VPC Flow Logs — without shipping prompt bodies.
On 8 Sep 2026 AWS let API Gateway REST APIs present an ACM (or Private CA) client certificate to backends for mutual TLS — replacing the old self-signed outbound cert. UK zero-trust playbook for FS/healthcare PKI, stage config and CAB evidence.
AI Control Tower Aug/Sep 2026 ships a Kill Switch that revokes agent credentials across Okta, GCP and AWS Bedrock and stops agents at runtime — cutting mean time to contain from ~30 minutes to seconds. UK CISO playbook before you treat it as production IR.
AgentCore Policy is GA (Mar 2026) with Cedar at the Gateway and Dogwood temporal rules for session trajectory. UK playbook: LOG_ONLY → ENFORCE, session IDs and high-risk tool gates.
Zurich put Vault Console and Machine Identity Console beside agentic AI. UK CISOs need a native control playbook — encryption, NHI hygiene and Zero Trust — not another bolt-on slide.
Knowledge 2026 put Armis asset intelligence and Veza identity graphs on ServiceNow security plane. Here is a 30-day UK path to govern AI agents, NHIs and connected assets without a rip-and-replace.
September 2026 adds an AWS-hosted Consent Portal for Amazon Bedrock AgentCore Identity so users can grant OAuth access without the browser holding tokens. Here is the UK IdP and gateway checklist.
Regulated UK organisations need Retrieval-Augmented Generation that is accurate—and governable. This guide combines Bedrock Knowledge Bases, Guardrails, audit patterns and responsible AI practices into one operating model.