AWS Partner Network (APN) Blog

OTTera cuts scheduling time by 60% with AI on Amazon Bedrock

Venky Hosur — Wed, 11 Nov 2026 18:50:00 +0000

By: Venky Hosur, Sr. Partner Solutions Architect – AWS
By: Ed Ip, Principal Solutions Architect – AI/R Compass UOL
By: Elizabeth Burton, Head of Marketing, North America – AI/R Compass UOL

OTTera is a white-label streaming service powering more than 2,000 FAST channels worldwide. By replacing a manual, rules-based process with AI on Amazon Bedrock, OTTera cut schedule creation time by 60%. Partnering with AI/R Compass UOL and AWS, OTTera built an AI-driven decision engine powered by Amazon Bedrock AgentCore, Amazon SageMaker AI, Amazon Athena, and Amazon Redshift. Beyond speed, the transformation delivered more than $6.3 million* in projected Year 1 net profit and a scalable model for turning proprietary data into real-time business decisions.

The business impact

For media and streaming companies, scheduling decisions directly influence audience retention, advertising yield, and content monetization. As content libraries grow and viewer preferences shift in real time, relying on manual processes and historical analysis alone can limit revenue potential and slow decision-making. With AI-driven scheduling, organizations can continuously evaluate performance data, audience behavior, and programming options to make smarter, faster decisions at scale. With proprietary data turned into actionable insights, you can optimize engagement, improve profitability, and create more personalized viewing experiences. More importantly, you can transform scheduling from an operational task into a strategic advantage, using data-driven decision-making to differentiate your services and compete more effectively in an increasingly crowded streaming landscape.

The challenge

OTTera’s core scheduling tool sits at the center of its ad-supported streaming business. Hundreds of streaming networks with thousands of channels rely on OTTera to build programming schedules that directly influence audience engagement, content performance, and advertising revenue. Two critical challenges limited OTTera’s ability to scale. First, the scheduling workflow was highly engineering-dependent, requiring technical expertise for routine scheduling and optimization tasks. This created operational bottlenecks that slowed the pace of schedule changes and made it difficult for network operators to react quickly to changing audience behavior or monetization opportunities. Second, valuable insights across content performance, audience engagement, and advertising revenue were fragmented across multiple systems, preventing network operators from using that data to make intelligent scheduling decisions. These constraints slowed OTTera’s ability to deliver features that would help network operators react to shifting viewer patterns and transform historical data into actionable decisions.

This led to reduced revenue optimization opportunities and slower innovation across OTTera’s networks. OTTera had already taken a first step toward addressing this with an AI Server built on Amazon Bedrock. However, its use was limited to a small set of basic, fixed-prompt scheduling tasks. OTTera needed a broader solution – one that would remove the engineering dependency limiting day-to-day scheduling, unify its fragmented data assets, and use AI to automate and optimize scheduling decisions in real time, turning its data estate into a strategic differentiator and a new source of growth for both OTTera and its networks.

Solution overview

To help OTTera scale and unlock growth, AI/R Compass UOL executed a phased AWS transformation that modernized the system, enhanced monetization, and embedded AI into scheduling.

Phase 1: Modernized the scheduling tool, giving operators self-service control and alleviating engineering bottlenecks.
Phase 2: Enriched advertising metadata and integrated programmatic ad systems to monetize inventory.
Phase 3: Identified and prioritized scheduling use cases with the highest business impact.
Phase 4: Validated top use cases via proof of concept on Amazon Bedrock, confirming feasibility and value.
Phase 5: Deployed AI agents powered by Amazon Bedrock AgentCore, supported by Amazon SageMaker AI, Amazon Redshift, AWS Glue, and Amazon Athena to deliver intelligent scheduling recommendations at scale.

With this architecture, OTTera can turn its data into a strategic asset — making faster decisions, delivering better programming, and increasing monetization.

“AI/R Compass UOL helped us level up our scheduler, taking it from an operational challenge to a strategic tool. Our team and clients can now make faster, more informed programming decisions, improving audience engagement, channel quality and performance, and revenue.”
– Craig McEldowney, CTO & Co-Founder, OTTera

How it works

AI/R Compass UOL built an AI-powered scheduling tool on AWS that replaces manual planning with conversation-driven automation. Operators type natural-language requests — like “optimize prime-time for sports” — and the system applies business rules, evaluates options using machine learning, and returns ranked recommendations with clear explanations. Schedules that took hours now publish in minutes.

The system spans three AWS layers:

Request handling: Requests are authenticated via Amazon Cognito, authorized and routed through Amazon API Gateway, processed by AWS Lambda, and persisted in Amazon DynamoDB.
AI decision-making: Amazon Bedrock AgentCore orchestrates Anthropic’s Claude model to interpret requests, maintain context, and retrieve content from a knowledge base powered by Amazon OpenSearch Service.
Data and ML pipeline: Amazon EventBridge, AWS Step Functions, AWS Glue, and Amazon SageMaker AI process audience and revenue data, stored in Amazon S3 and queried via Amazon Athena and Amazon Redshift.

These layers turn OTTera’s data into scheduling intelligence delivered at scale.

Figure 1 — OTTera AI-driven scheduling architecture on AWS

Results

The transformation delivered measurable business impact for OTTera and its network customers, turning a manual, engineering-dependent scheduling process into an AI system running on AWS. Schedule creation time decreased by 60%, allowing networks to respond more quickly to audience trends and programming opportunities. AI-driven scheduling is also projected to increase viewer engagement by 15—25%*, helping OTTera’s customers deliver more relevant content experiences and improve monetization outcomes.

The business impact is equally significant, with projected Year 1 net profit exceeding $6.3 million*. Today, OTTera is running production AI agents that make revenue optimization decisions for live streaming content viewed by millions of consumers, transforming scheduling from a manual workflow into an intelligent, data-driven revenue system. The following table shows the impact of AI-driven scheduling.

* Based on OTTera’s internal estimates and performance modeling, 2026. Individual results may vary based on content library size, audience scale, and market conditions.

Function	Before	After
Schedule creation	Manual, engineering-assisted	60% faster creation
Revenue analysis	Spreadsheet-driven	AI-driven recommendations
Decision making	Historical review	Real-time insights
Scheduling optimization	Human-led	AI-assisted and data-driven

Table 1 — Impact of AI-driven scheduling

Key takeaways

Modernize first, then operationalize AI. Organizations achieve faster and more sustainable results when AI is built on a modern, scalable technology foundation.
Data quality determines AI value. A unified, accessible, and real-time data layer is the prerequisite for reliable AI-powered decision-making.
Start with business value, not technology. Prioritize and validate high-impact use cases before scaling to make sure investments align with measurable outcomes.
Embed AI where decisions drive results. The most successful AI initiatives move beyond productivity gains to improve revenue, customer experience, and operational performance.

Conclusion

OTTera’s journey demonstrates that realizing AI’s full potential requires more than deploying models—it requires the right foundation, the right data strategy, and a clear path to production. For organizations looking to unlock greater value from proprietary data, the key is to apply AI where it can directly impact revenue growth, customer experience, and operational performance. By modernizing core systems, creating a trusted data foundation, and scaling proven use cases, you can move beyond AI experimentation. That foundation is what delivers measurable business outcomes at scale. OTTera’s success provides a practical blueprint for transforming AI from a technology initiative into a competitive advantage.

AI/R Compass UOL – AWS Partner Spotlight

AI/R Compass UOL is a subsidiary of the AI Revolution Company, and an AWS Premier Tier Services Partner specializing in AI transformation, cloud modernization, and data-driven innovation. With 12 AWS Competencies, AWS Managed Service Provider (MSP) designation, more than 1,900 AWS certifications, and hundreds of successful customer launches, AI/R Compass UOL helps organizations accelerate their journey from proof of concept to production. AI/R Compass UOL combines deep industry expertise with AWS technologies to help you modernize applications, operationalize AI, optimize business processes, and achieve measurable business outcomes at scale.

Contact AI/R Compass UOL | Partner Overview | AWS Marketplace

How Denodo and Amazon SageMaker Deliver a Data Foundation for Agentic AI

Carl Luo — Wed, 11 Nov 2026 18:07:17 +0000

By: Mitesh Shah, Global Director, Cloud Alliances and GTM – Denodo
By: Carl Luo, Partner Solutions Architect – AWS

The race to production agentic AI has been dominated by model selection: which foundation model, which fine-tuning approach, which orchestration framework. But models are commoditizing fast. According to RAND Corporation, more than 80% of AI projects fail to deliver their intended business value. Gartner reports that 63% of organizations lack the data management practices required for AI. The real bottleneck is not the model. It is the data foundation. Without governed, real-time access to enterprise data, agents hallucinate, act on stale context, and fail to deliver business outcomes. The organizations that get agentic AI into production are solving the data problem first.

However, in today’s hybrid and multi-cloud data landscapes, secure access to the full data estate is constrained by compliance requirements, cost pressures, and technical debt. AI initiatives stall because data remains siloed, extract, transform, and load (ETL) pipelines introduce latency, and replication creates governance blind spots. AI agents cannot reason accurately when they lack complete, current context.

Denodo and AWS deliver a unified context-ready data foundation for agentic AI

To solve this, Denodo and AWS deliver a joint architecture that provides AI agents with governed, real-time access to enterprise data across hybrid, multi-cloud, and sovereign environments without requiring data replication. AI does not just need access to data. It needs the right information, with the right meaning and controls, at the moment it is needed. Denodo calls this “active context.” Unlike a single product integration or customer story, this post focuses on why the data layer, not the model, is the bottleneck, and how the Denodo and AWS partnership addresses it across financial services, healthcare, and life sciences, including a customer example from a multi-national bank.

AWS delivers enterprise-grade data and AI services: Amazon SageMaker as the center for data, analytics, and AI, including Amazon SageMaker AI for building, training, deploying, and managing machine learning (ML) models; Amazon Bedrock for foundation model access and Amazon Bedrock AgentCore for building, connecting, and operating agents securely at scale; and Amazon Quick for AI-powered research, business insights, and automation. These services enable enterprises to reuse components instead of building one-off stacks for each business unit.

The Denodo Platform on AWS establishes an AI data layer between distributed enterprise data and the AI systems, applications, analytics platforms, and people that consume it. It creates a reusable way to connect, govern, contextualize, and deliver data without requiring another consolidation or replacement cycle. This layer also includes unified semantics across the AWS and non-AWS data sources.

AI agents connect once and gain governed access to 200+ distributed data sources through zero-copy data access across AWS and non-AWS sources, standardized business definitions and metrics, and fine-grained security and governance controls. Together, the joint solution extends the reach of Amazon SageMaker, Amazon Bedrock, and Amazon Quick to data that resides outside of AWS: on-premises systems, sovereign clouds, and other cloud platforms.

Figure 1: High-level architecture – The Denodo and AWS joint solution for agentic AI

Solution capabilities

The Denodo solution, with integrations into AWS AI and data services, delivers the following:

A unified semantic layer with business context. The Denodo Platform standardizes business definitions, metrics, and relationships in a single shared layer across Amazon SageMaker Lakehouse, Amazon Redshift, Amazon S3, Amazon Aurora, and on-premises and multi-cloud systems.

Live data across hybrid and multi-cloud environments. Operational and analytical data is accessible across the entire enterprise data estate without requiring replication. Denodo’s architecture enables AI agents to reason on live data across AWS and non-AWS systems, with connectivity to more than 200 enterprise data sources.

Governance and security across the data estate. Consistent security and governance are enforced across all data assets. Denodo governs non-AWS sources alongside Amazon SageMaker’s native controls for AWS data. Sensitive data is protected through fine-grained access controls, dynamic data masking, and end-to-end data lineage.

AI-ready data through standard interfaces. AI agents built on AWS AI services consume governed, real-time data with embedded context, lineage, and policy enforcement. Through Model Context Protocol (MCP), metadata embeddings, and text-to-SQL capabilities, Denodo transforms enterprise data into the active context that agents can securely discover and use.

How the solution works

The solution works across five layers, moving data from fragmented sources to intelligent AI consumers:

1. Unified data connectivity. Denodo integrates over 200 distributed data sources, including on-premises systems, multi-cloud environments, and SaaS applications. All enterprise data is accessible for AI reasoning without requiring data replication.

2. AWS data integration. Denodo integrates directly with native AWS data services such as Amazon S3, Amazon Redshift, and Amazon Aurora. It provides a unified view across Amazon SageMaker Lakehouse and external systems through native connectivity to Amazon Athena, Amazon Redshift, and Amazon EMR.

3. Amazon SageMaker Catalog synchronization. Denodo establishes a shared semantic layer that standardizes business definitions and metrics. It integrates with Amazon SageMaker Catalog, enabling metadata to be discoverable, and it provides the business context AI agents need to operate accurately.

4. Semantic layer and governance enforcement. Consistent security policies, including fine-grained access controls and dynamic data masking, are applied across non-AWS data sources. Denodo honors existing policies defined in AWS Lake Formation. Logical data products combine data into a shared semantic layer using Denodo’s no-code graphical interface.

5. AI consumption and orchestration. AI services consume this data through standard interfaces: API, MCP, ODBC, JDBC, and Python libraries. These services span agent orchestration (Amazon Bedrock AgentCore and Amazon Bedrock Flows), AI and ML (Amazon SageMaker AI), and AI-powered consumption (Amazon Quick). AI agents and workflows run real-time tasks and complex analytical queries with trusted, governed context.

Enabling AI-driven use cases across industries

Denodo and AWS deliver a scalable data foundation that powers agentic workflows across industries, from financial services and healthcare to manufacturing and retail.

Fraud detection and prevention

Denodo and AWS enable insurers to monitor claims, transactions, and behavioral signals in real time without copying data across systems. AI agents deployed on AWS access live, governed enterprise data to detect suspicious patterns earlier and adapt to emerging fraud schemes faster. Insurers reduce fraud losses through earlier detection, AI-driven anomaly identification, and autonomous actions.

Clinical decision support

Healthcare providers deliver real-time clinical signals, from diagnostics to medication history, to care teams at the point of care. AI agents use this context to surface insights faster and reduce the clinician burden. Denodo and AWS enable providers to improve patient outcomes while maintaining governance and security.

Drug safety monitoring

Life sciences organizations monitor adverse events across clinical, post-market, and partner data through zero-copy access to distributed systems. AI models and agents can access governed pharmacovigilance data to detect safety signals earlier and accelerate regulatory response.

Customer use case

A pan-African financial institution operating across 15 countries faced a data access challenge. Customer and transactional data were fragmented across dozens of applications spread across multiple geographies. Each integration project took months. Cloud costs were climbing because of constant data movement and duplication. Fraud detection was delayed because analysts waited for consolidated data extracts rather than acting on live signals. Regulatory reporting was manual and error prone.

The bank chose a logical data management approach over traditional lift-and-shift migration. With Denodo as the unified semantic layer and AWS as the cloud foundation, the organization connected its entire data estate without replicating it. Business applications and AI workflows connect to Denodo’s abstraction layer rather than underlying databases. This enabled backend migrations to AWS (Amazon S3, Amazon Redshift, AWS Glue for cataloging) to happen without breaking downstream reporting or AI pipelines. Amazon SageMaker AI consumed curated data from Denodo to handle ML processing for fraud detection and regulatory use cases.

The results validated the approach:

4PB migrated to AWS in 3 months without disrupting downstream reporting or AI pipelines
70–90% reduction in integration effort
2M queries/month across 1,300+ users
Faster fraud detection and decision-making

This case demonstrates why the data foundation, not the model, is what enables enterprise AI and ML to deliver at scale. The bank succeeded by first solving the data access and governance problem.

Delivering business outcomes

Organizations using Denodo and AWS can accelerate enterprise AI adoption:

Faster insights. Real-time analytics and AI-driven decisions that previously took weeks.
Cost optimization. Reduced data movement and duplication lower operational costs.
Regulatory compliance. Governance, security, and sovereignty requirements enforced across all data sources.

Together, Denodo and AWS help organizations securely connect their entire data estate and power AI agents at scale.

Get started with Denodo on AWS

Denodo is the AI data layer company. The Denodo Platform powers trustworthy agents and applications, transforming enterprise data into reliable insights for analytics and self-service. Organizations worldwide deploy Denodo alongside their data lakehouses to deliver AI-ready, business-ready data in a fraction of the time—achieving up to 4x faster time to insight. Visit denodo.com. Denodo for AWS and Agora on AWS (Managed SaaS Offering) are available via AWS Marketplace.

Denodo – AWS Partner Spotlight

Denodo is an AWS Advanced Tier Technology Partner with the AWS Data Competency and the AWS Financial Services Competency.

Contact Denodo | Partner Overview | AWS Marketplace

Taking control of agents on Amazon Bedrock AgentCore with Dataiku

Ankit Mathur — Tue, 10 Nov 2026 22:32:11 +0000

By: Ankit Mathur, Partner Solutions Architect – AWS
By: Mike Osborne, Field Engineering Lead, North and Central Europe – Dataiku

Agent estates are growing from a handful of pilots to hundreds of agents in production. At that scale the question is no longer whether a team can build an agent on Amazon Bedrock, but which agents to stop and which to promote. Answering it takes control and accountability, not just visibility.

Dataiku built Agent Management for that job. It turns the signals Amazon Bedrock AgentCore emits through Amazon CloudWatch into one inventory, an audit trail, and enforceable controls.

This post looks at how Dataiku Agent Management and Amazon Bedrock AgentCore work together, and why that matters for production agents on AWS.

Operational challenges for scaling production agents

A proof of concept has one agent and one owner. Production has many, spread across teams, and the questions change. Which agents are still live? What did each one actually do on a given request? How is it performing, and when something goes wrong, can you show what happened and who signed off?

Traditional observability answers infrastructure questions: is the service up, is latency within bounds. Those still matter, but they say little about an agent that stays healthy on every dashboard while making a decision you would not have approved. Accountability for agents means seeing the decisions, not just the uptime, and that is the gap Agent Management fills on AWS.

A control layer for Amazon Bedrock agents

Agent Management is a monitoring and control layer, not an agent runtime. It does not host your production agents; it observes them, connecting to Amazon Bedrock through the AWS SDK to build a live picture of your agent estate from the metadata, telemetry, and metrics AWS already produces.

Your agents stay where they run, and when you self-host, your data stays in your account too.

Building on AgentCore’s native observability

Amazon Bedrock AgentCore gives you a strong foundation. AgentCore Observability surfaces session-level metrics such as latency, token usage, and error rates in Amazon CloudWatch, along with spans and traces once you enable instrumentation. AgentCore Evaluations scores agent quality from those traces, on demand or continuously against live traffic, and Amazon Bedrock Guardrails, applied directly to model calls or enforced at the AgentCore Gateway through AgentCore Policy, screens inputs and outputs for prompt injection, harmful content, and sensitive information. For agents running on a single AgentCore runtime, much of what you need for visibility and control is already in place.

Agent Management reads from that foundation rather than replacing it. It consumes the same Amazon CloudWatch telemetry and adds breadth on top: one place to view and control agents across AgentCore, Amazon Bedrock, and other environments. It adds agent cost and return on investment (ROI) oversight, risk certification, and recurring testing and alerts. AgentCore gives you depth for each agent it runs. Agent Management gives you one system of record for agents, wherever they operate.

Solution overview

Agent Management runs on AWS in two shapes.

Self-hosted – Agent Management runs on an Amazon Elastic Compute Cloud (Amazon EC2) instance inside your own Amazon Virtual Private Cloud (Amazon VPC), with a private subnet, a security group, and an AWS Identity and Access Management (IAM) role that grants the access it needs to Amazon Bedrock and Amazon CloudWatch.
Software as a service (SaaS) – Dataiku operates Agent Management in its own AWS account and connects to yours through a cross-account IAM role you create and can revoke when you choose. It keeps agent metadata and operational metrics in its account; collected and processed telemetry can go to Amazon Simple Storage Service (Amazon S3) buckets you provide instead.

Figure 1 shows the self-hosted reference architecture, with collected telemetry written to an Amazon S3 bucket in your account.

Figure 1 – Self-hosted reference architecture – Agent Management on Amazon EC2 in the customer’s Amazon VPC, writing normalized telemetry to Amazon S3.

How the integration works

Agent Management works through the AWS SDK and the APIs that AgentCore and Amazon CloudWatch already expose, using an IAM role you control. It discovers the agents in the account, checks that each one is healthy, and reads the traces and metrics AgentCore writes to CloudWatch to reconstruct what each agent did: the request, the steps, and the outcome. Because it reads common trace formats, a mixed estate lands in one consistent view. Figure 2 shows the resulting inventory.

Figure 2 – Agent Inventory – agents discovered on Amazon Bedrock, showing purpose, activity, and organizational metadata.

For customers with existing Amazon Bedrock Agents Classic workloads, Agent Management provides discovery, metadata, health status, and CloudWatch metrics. Trace-level observability is not available, because Agents Classic does not persist traces. AgentCore, the recommended path for new agents, does, and this post centers on it.

In the self-hosted pattern, heavier trace and session data lands in a connected store in your own account: Amazon S3 by default, for scalable, low-cost storage, or Amazon Relational Database Service (Amazon RDS) for PostgreSQL where a relational store is preferred.

Security by design

A tool that provides oversight of agents reads their traces, so it has to meet a higher bar than the agents it watches. By default, the IAM role you create gives Agent Management read access to Amazon Bedrock, AgentCore, and Amazon CloudWatch. If you turn on uptime tests or emergency actions, you add permissions to invoke, disable, or delete the agents in scope. You can audit the role’s API activity with AWS CloudTrail, and Agent Management uses AWS mechanisms to encrypt data at rest and in transit.

Business value for AWS customers

Illustrative scenario – a retail bank has put dozens of agents into production on Amazon Bedrock across several teams. Beyond a small number of high-profile agents, no one can say with confidence which agents are still live, what each is doing, or who owns the outcome. A single, estate-wide view is what brings that sprawl back under control.

Industry benchmark – in the Global AI Confessions Report: CIO Edition, 2026, a Dataiku and Harris Poll survey of 685 CIOs, 83% lack standardized agent lifecycle management and 72% cannot consistently confirm their agents deliver the business outcomes they were built for.

Faster oversight – once agent sessions are reconstructed and searchable in one place, reviews that span the estate take less time.
Wider visibility – agents across AgentCore, existing Amazon Bedrock Agents Classic deployments, and other environments can be brought into one inventory.
Earlier detection – trace-level visibility and risk certification surface issues earlier.

Figure 3 shows the risk matrix. Teams define risks from their own risk taxonomy and assign them to agents, and the matrix plots them by likelihood, impact, and mitigation status.

Figure 3 – Risk matrix – risks across the managed estate by likelihood, impact, and mitigation status.

Key takeaways

Start from existing telemetry – read the signals AWS already emits rather than re-instrumenting agents, so new controls add little operational overhead.
Keep data in the account – the self-hosted pattern keeps agents and trace data inside the customer’s AWS account.
Analyze decisions, not health – review reconstructed sessions and business impact, not just uptime, to see what an agent did and what it delivered.
Target AgentCore – AgentCore is the primary integration target and the recommended path for new agents, with existing Amazon Bedrock Agents Classic deployments supported where their architecture allows.

Conclusion

If you are running agents on Amazon Bedrock AgentCore, providing visibility and control does not have to mean building a second system. Agent Management connects to your AWS account, reads what AgentCore already emits, and gives you one inventory and audit trail as your system of record, while you keep building on Amazon Bedrock.

To explore the AWS services in this post, visit Amazon Bedrock and Amazon Bedrock AgentCore. The SaaS edition of Dataiku Agent Management is available in AWS Marketplace. To learn more about the Dataiku approach to agent management, visit Dataiku.

Dataiku – AWS Partner Spotlight

Dataiku is an AWS Technology Partner in the Advanced tier, with its Software Path at the Differentiated stage. It is ACE eligible and a member of ISV Accelerate and the AWS ISV Workload Migration Program. It holds three AWS Competencies: the Machine Learning ISV Competency, the AI Software Competency, and the Healthcare ISV Competency. Dataiku Agent Management extends the Dataiku platform to the discovery, monitoring, and control of AI agents running on Amazon Bedrock AgentCore and beyond.

Contact Dataiku | Partner Overview | AWS Marketplace

Disclaimer

This post is for educational purposes. The architecture and configuration shown here are illustrative and should not be deployed to production environments without additional security testing. Work with your security and legal teams to meet your organization’s security, regulatory, and compliance requirements before deployment. The content and opinions in this blog are those of the third-party author and AWS is not responsible for the content or accuracy of this blog.

Simplifying AWS Outposts Operations at Scale with CloudPrimus

Sumeeth Siriyur — Tue, 10 Nov 2026 22:09:28 +0000

By: Sumeeth Siriyur, Hybrid Edge SA – AWS
By: Jitender Singh, Solutions Architect – Comquest
By: Alfian Abdi, Solutions Architect – Xtremax
By: Raja Rajaram, Hybrid Edge BD – AWS

As AWS Outposts deployments scale across multiple teams and customers, organizations need consistent ways to manage shared compute and storage capacity across tenants. In this post, we explore how CloudPrimus builds on the Outpost capabilities to provide a centralized operational layer for tenant onboarding, self-service provisioning, shared-capacity allocation, and consolidated cost visibility.

AWS Outposts extends AWS infrastructure and services to your data center, colocation facility, or edge location. This supports workloads that require low-latency access to on-premises systems, local data processing, or data residency. AWS Organizations provides a foundation for managing multiple AWS accounts. You share an Outpost rack across accounts in the same organization using AWS Resource Access Manager (AWS RAM). AWS services and APIs provide the underlying infrastructure and account-level controls.

Comquest Brunei, a Brunei-based technology and cloud services partner, uses CloudPrimus to operate an Outpost environment on behalf of several business units and customers. With this model, Comquest has cut provisioning time by 50% and reduced manual capacity tickets by 45% compared with its previous ticket-based process, based on Comquest’s internal operational data. Throughout the post, tenant refers to a separate AWS account consuming capacity from a single, shared Outpost within an organization environment.

Augmenting native AWS Outposts capabilities at scale
With CloudPrimus, Cloud Management Platform (CMP) teams can operate cloud infrastructure without routing every request through a central IT ticket queue. They can also avoid exposing the AWS Management Console and APIs to every team. CloudPrimus provides two core capabilities for managing Outposts operations:

Cloud identity and tenant management: Federate identities from your on-premises corporate identity provider. Define tenant boundaries and assign role-based access to control resources.
Capacity and billing management: Provide a self-service catalog and orchestration engine for AWS APIs. Approval workflows and capacity controls govern provisioning, while consolidated billing covers Outpost and AWS Region consumption.

Together, these give you a single control point for the Outposts service lifecycle.

How CloudPrimus manages the Outposts lifecycle
CloudPrimus extends Outposts operations with automated workflows for capacity management, service provisioning, monitoring, and billing. CloudPrimus supports managed SaaS delivery. The following workflow shows how CloudPrimus supports the Outposts lifecycle, from initial discovery and account setup through capacity allocation, provisioning, monitoring, and billing.

Connect and discover: Find Outposts resources and available capacity across AWS accounts and Outposts deployments to establish a centralized operational view.
Manage accounts and access: Align tenants with your AWS Organizations, business units, and organizational structures, while applying role-based access controls and approval workflows.
Allocate shared capacity: Track allocated, consumed, and available capacity across tenants to improve utilization and support informed allocation decisions.
Simplify service provisioning: Authorized users can request approved services, including Amazon EC2, Amazon EBS, Application Load Balancer (ALB), customer-owned IP (COIP) addresses, and Amazon S3 on Outposts, through the self-service portal.
Monitor usage and plan capacity: Tenants can see their resource consumption and request additional capacity. Administrators can reallocate available capacity or plan an Outpost expansion when physical capacity limits are reached.
Attribute and consolidate billing: Attribute resources and usage to the correct account. You can view consolidated billing across Outpost and parent AWS Region consumption for unified showback or chargeback.

Tenant Dashboard – CloudPrimus tenant dashboard with tiles for Account Management, Service Catalog, Service Management, Quota Allocation, and Service Request.

Figure 1. Tenant dashboard with direct access to CloudPrimus service modules.

Self-service provisioning and management through CloudPrimus
CloudPrimus provides a self-service catalog scoped to the capabilities of the target Outpost. Authorized users can request approved resources within defined tenant allocations. This reduces provisioning delays and administrative overhead while maintaining governance.

Amazon EC2 instances: Provide a catalog of instance types and sizes available on the target Outpost for consistent, approval-based provisioning.
Amazon S3 on Outposts: Automate bucket, endpoint, and access point configuration using standardized access policies and encryption baselines.
Application Load Balancer: Simplify load balancer provisioning with reusable target group and listener configurations that keep networking and security practices consistent.
Customer-owned IP (COIP) addresses: Authorized users can select addresses from approved COIP pools during deployment, which reduces manual IP allocation while enforcing tenant and network policies.

CloudPrimus tags every resource at creation with the requesting account, department, and cost center.

Service Catalog – CloudPrimus service catalog listing Outpost services such as EC2, S3, ALB. Each service shows whether quota is available.

Figure 2. Tenant service catalog showing Outpost services and quota requirements.

Per-tenant capacity and quota management
CloudPrimus holds the capacity configuration of each Outpost and traces every provisioned resource back to the requesting account.

Per-account allocations: CloudPrimus administrators assign soft or hard limits for Amazon EC2, Amazon EBS, Amazon S3 on Outposts, and other catalog resources, according to each tenant’s entitlement.
Pre-provision validation: CloudPrimus checks each request against the tenant’s remaining allocation and the Outpost’s actual available capacity before it proceeds.
Threshold visibility and alerts: Administrators and tenants can see consumption against allocation and get an early warning as usage nears a threshold.
Additional-capacity requests: A tenant can request additional capacity directly from CloudPrimus, providing the required service, quantity, business justification, and target date for review and approval.

Service Quotas provides quota controls for supported AWS services in an AWS Region. CloudPrimus complements these controls with tenant-level allocation and pre-provisioning checks against the capacity available on a shared Outpost.

Quota allocation – CloudPrimus quota table showing allocated and used capacity for each Outpost service.

Figure 3. Tenant quota allocation and utilization by Outpost service.

Tenant, user, and role management
CloudPrimus provides a central platform for operating multiple customer tenants, while keeping each account, resources, approvals, and commercial information logically separated:

Tenant management: Create and maintain tenant profiles and map them to cost centers or departments. Assign service entitlements and associate each tenant with an approved capacity allocation.
User lifecycle management: Onboard, update, suspend, or remove users directly or through synchronization with the organization’s identity source.
Role-based access control: Separate responsibilities among platform administrators, tenant administrators, requesters, approvers, operators, and billing viewers, so users receive only the access their role requires.
Tenant-scoped visibility and audit: Users are scoped to authorized requests, resources, capacity, and billing, while administrators keep a complete audit trail across tenants.

Tenant management – CloudPrimus tenant management page listing active tenants.

Figure 4. Tenant management for shared CloudPrimus environments.

Consolidated billing across your Outpost and the parent AWS Region
CloudPrimus attributes resources and usage to the correct account and consolidates consumption on your Outpost and in the parent AWS Region into one billing module. This can reduce the need for separate reports and manual reconciliation, giving you a consistent account-level view.

Billing report – CloudPrimus monthly billing report with charges for Outpost services, including EC2, EBS, S3, ALB, and COIP.

Figure 5. Tenant billing report for Outpost consumption and consolidated charges.

Organizations often run Outposts in regulated environments, including government agencies, financial services firms, and shared-services providers. Several business units might consume a single physical Outpost, which makes granular cost attribution important for governance and cost visibility.

Conclusion
In this post, we showed you how CloudPrimus builds on Outposts and AWS Organizations to help you manage tenant administration, self-service provisioning, shared-capacity governance, and consolidated billing. If you operate a shared Outpost across multiple AWS accounts, start by opening the AWS Outposts console and comparing installed capacity against the accounts consuming it. For more information, see the AWS Outposts User Guide and the Guidance for Multi-Account Outposts Operations on AWS. To discuss CloudPrimus for your environment, contact your AWS account team and Xtremax.

The content and opinions in this blog are those of the third-party author and AWS is not responsible for the content or accuracy of this blog.

Xtremax – AWS Partner Spotlight

Xtremax is an AWS Advanced Tier Partner and AWS Managed Service Provider (MSP) who delivers cloud engagements across public sector, financial services, and enterprise customers in Southeast Asia.

Contact Xtremax | Partner Overview | AWS Marketplace

Automating compliance testing with Fisent, Launchpad.io, and Amazon Bedrock

Ujwal Bukka — Tue, 10 Nov 2026 17:10:30 +0000

By: Ujwal Bukka, Senior Partner Solutions Architect – AWS
By: Brent Baiotto, COO – Fisent Technologies
By: Calvin Mickael, AWS Alliance Director, Launchpad.io – Pegasystems

Regulation E compliance testing is becoming harder for financial institutions and fintechs to scale, as regulators expect consumer dispute investigations to be handled consistently, accurately, and in line with error-resolution requirements. In this post, you learn how Kaufman Rossin used Fisent BizAI, Launchpad.io by Pegasystems, and AWS to automate that testing. For advisory firms that help these organizations assess compliance performance, the challenge is not only regulatory expertise—it is scale.

Each dispute review may depend on evidence scattered across case files, emails, chats, call recordings, scanned documents, correspondence, and other unstructured materials. If your team performs compliance testing, organizing and interpreting that evidence can require significant manual effort before your experts can even begin their analysis.

Kaufman Rossin, a risk advisory firm, set out to scale its Regulation E risk intelligence offering while preserving the controls, auditability, and expert oversight required by regulated financial-services customers. To achieve that goal, Kaufman Rossin worked with Fisent Technologies, Launchpad.io by Pegasystems, and AWS to develop RegE|RI, an Outcomes-as-a-Service platform for Regulation E compliance testing and monitoring.

RegE|RI combines deterministic workflow automation, applied generative AI, content intelligence, and AWS cloud infrastructure. With it, fintechs and financial institutions can automate and manage critical dispute monitoring workflows at scale.

Scaling Regulation E risk intelligence

Regulation E dispute testing requires consistent, evidence-based review of consumer error-resolution processes, often across account records, correspondence, case notes, third-party data, and call recordings. Before, Kaufman Rossin’s process was fully manual and time consuming, particularly when evidence arrived unlabeled or in unstructured formats.

RegE|RI turns this expertise-heavy service into a software-enabled Outcomes-as-a-Service model. Launchpad.io by Pegasystems provides deterministic workflow control; Fisent BizAI structures unstructured evidence and produces AI-assisted observations; and AWS provides the cloud-native foundation. Together, document storage, guided workflows, real-time reporting, call transcription, and human review let organizations scale testing and monitoring. Throughout, teams keep the accuracy, transparency, and audit trails they need to make defensible decisions.

This approach expands testing capacity while keeping compliance professionals focused on exceptions, final determinations, and higher-value advisory work.

The power of collaboration: Kaufman Rossin, Fisent, Launchpad.io by Pegasystems, and AWS

Figure 1 – RegE|RI solution architecture overview

The preceding figure shows the RegE|RI solution architecture overview; the components are described in the following list:

Kaufman Rossin brought deep Regulation E risk advisory expertise, practical knowledge of dispute testing, and the customer-facing Outcomes-as-a-Service model.

Launchpad.io by Pegasystems provided the workflow automation layer used to structure deterministic, rule-based processes. These workflows help guide case progression, support exception routing, and enable consistent operational execution.

Fisent Technologies provided BizAI, its applied GenAI and content intelligence platform. BizAI automates the ingestion, interpretation, extraction, and structuring of unstructured compliance evidence so that downstream workflows can act on reliable, normalized data.

AWS provided the secure, scalable cloud foundation on which RegE|RI runs. The solution was built to support scale, data security, and cloud-native architecture.

Together, the four organizations helped Kaufman Rossin bring a software-enabled compliance testing offering to market, while preserving the controls and human review paths required for regulated financial-services use cases.

How RegE|RI works

RegE|RI moves organizations from manual dispute testing to a structured, automated compliance monitoring model. Figure 2 shows the service delivery model.

Figure 2 – RegE|RI high-level service delivery model

Figure 3 shows the high-level process flow.

Figure 3 – RegE|RI high-level process flow

At a high level, the platform supports the following flow:

Evidence intake
Dispute-related materials are collected from financial institutions, fintech partners, or internal teams. These materials may include structured documents, unstructured files, correspondence, chats, emails, scanned PDFs, call recordings, or other compliance evidence.
Content understanding and extraction
Fisent BizAI processes the incoming materials, detects file types, converts content when required, extracts relevant information, and structures that information for downstream workflow use.
Confidence scoring and exception handling
BizAI applies confidence scoring and efficacy measurement to support automation decisions. High-confidence outputs can move through the workflow more quickly, while lower-confidence or incomplete items can be routed to human reviewers.
Workflow orchestration
Launchpad.io by Pegasystems guides the deterministic workflows used to manage case progression, business rules, routing, review steps, and reporting.
Compliance analysis and reporting
RegE|RI supports ongoing tracking, real-time reporting, and AI-assisted observations that help teams identify potential compliance issues for review.
Human review where needed
Compliance professionals remain in the loop for exceptions, escalations, and final determinations where expert judgment is required.

This design helps Kaufman Rossin and its customers combine automation speed with the oversight needed for regulated financial-services operations.

Architecture on AWS

BizAI runs on a secure, cloud-native foundation on AWS that connects enterprise workflow systems, content intake channels, and model-host options. Amazon API Gateway enables secure integration with upstream workflow applications such as Launchpad.io by Pegasystems, Amazon Cognito handles authentication and authorization, and Amazon Simple Email Service (Amazon SES) supports email-based content intake. BizAI orchestrates the processing that turns unstructured inputs into structured, use-case-specific outputs, and applies its GenAI Efficacy Framework (GEF) so you can gauge output confidence and decide where to automate versus apply human review.

For AI model execution, Amazon Bedrock provides scalable, approved model hosting alongside bring-your-own-model options, while BizAI maintains orchestration, routing, governance, and confidence-assessment logic. Together these AWS services give BizAI a secure, observable, and scalable foundation for processing across regulated enterprise workflows.

Customer impact and results

With RegE|RI, Kaufman Rossin designed, developed, tested, and deployed a B2B SaaS platform for sophisticated enterprise clients. Fintechs and financial institutions can now automate and manage critical dispute monitoring workflows within RegE|RI.

“RegE|RI allowed us to transform a manual, expertise-driven compliance testing process into a scalable Outcomes-as-a-Service platform. By combining Kaufman Rossin’s Regulation E expertise with Fisent BizAI, Launchpad.io by Pegasystems, and AWS, we can help clients monitor dispute compliance faster, more consistently, and with the transparency required in regulated financial services.”

– Jason Chorlins, Principal, Risk Advisory Services – Kaufman Rossin

According to Kaufman Rossin platform data, RegE|RI deployments scaled over a two-year period to support more than 30 fintechs that require regulatory testing as part of their compliance posture. Since launch, more than 100,000 dispute cases have been tested and monitored through the service.

The following table summarizes the business results, as measured by Kaufman Rossin by comparing RegE|RI-assisted testing against its prior manual testing process:

Outcome	Result
Fintech deployments	More than 30 fintechs supported over two years
Dispute cases tested and monitored	More than 100,000 cases since launch
Testing speed	70% faster on average
Human intervention	50% fewer hours required to test a typical dispute case
Deployment timeline	Typically less than one month to onboard and configure RegE\|RI

These results show how an Outcomes-as-a-Service model can help transform a manual compliance testing process into a repeatable, scalable, and software-enabled offering.

Conclusion

Kaufman Rossin’s RegE|RI platform demonstrates how advisory expertise, workflow automation, applied GenAI, and AWS cloud infrastructure can come together to create an Outcomes-as-a-Service model for regulated industries.

Kaufman Rossin transformed a manual Regulation E testing process into a scalable compliance monitoring platform by working with Fisent Technologies, Launchpad.io by Pegasystems, and AWS. Customers now spend less time on manual work and can expand testing capacity—without giving up the oversight that regulated financial-services operations demand.

As financial institutions and fintechs continue to modernize compliance operations, solutions like RegE|RI show how organizations can move from manual review to measurable outcomes—without sacrificing control, transparency, or expert judgment.

Call to action

If you are looking to modernize compliance testing, automate document-heavy workflows, or scale regulated operations, you can learn more about Fisent BizAI, Launchpad.io by Pegasystems, and AWS-based solutions for financial-services automation.

Read how Fisent Technologies is automating the last mile of enterprise automation
Discover how Launchpad.io by Pegasystems and AWS create Outcomes as a Service
Start a Free Trial of Launchpad.io by Pegasystems on the AWS Marketplace

Fisent Technologies – AWS Partner Spotlight

Fisent Technologies, AWS Select Tier Partner, transforms unstructured enterprise content into automated outcomes. With BizAI, organizations can automate document-heavy and knowledge-dependent processes within complex enterprise workflows across regulated industries, including banking, insurance, healthcare, lending, and wealth management.

BizAI combines content intelligence, applied GenAI, confidence scoring, model routing, and workflow integration. These capabilities support enterprise automation use cases where accuracy, auditability, and transparency are required.

Contact Fisent Technologies

Pegasystems / Launchpad.io – Partner Spotlight

Pegasystems is an AWS Advanced Tier Partner with AWS AI Competency that delivers AI-powered decisioning and workflow automation to major global enterprises. With Launchpad.io by Pegasystems, organizations can design and deploy rule-based, deterministic workflows for enterprise processes. In the RegE|RI platform, Launchpad.io by Pegasystems supports the structured workflow layer used to manage case progression, routing, review, and operational execution.

Contact Pegasystems | Partner Overview | AWS Marketplace

A Data-First Approach to Mainframe Modernization with AWS Transform and Qlik

Sathisan Vannadil — Tue, 10 Nov 2026 00:57:37 +0000

By: Giacomo Brioschi, Principal Solution Architect Technology Alliances — Qlik
By: Sean Williams, Senior Manager Partner Solution Architect — Qlik
By: Chris Poole, Senior Mainframe Partner Solution Architect — AWS
By: Sathisan Vannadil, Senior Partner Solution Architect — AWS

Qlik

AI agents are making mainframe migration programmable

With AWS and Qlik, AI agents are making mainframe modernization programmable – analyzing mainframe codebases, mapping data dependencies, and orchestrating incremental data replication. This turns mainframe modernization from a multi-year, all-or-nothing program into a data-first, wave-by-wave migration. At the core is Change Data Capture (CDC), which streams mainframe data to cloud targets in near-real-time. Combined with this capability, organizations gain a repeatable pattern for modernizing without disrupting production.

“Big bang” migrations, rewriting or replatforming entire portfolios in a single pass, carry significant risk: overrun timelines and budgets, plus data loss, transactional failures, and downtime when systems of record are disrupted. The strangler fig pattern for incremental migration, combined with blue/green deployment for safe cutovers offers a lower-risk, data-first alternative.

Four drivers are contributing to this shift:

Rising mainframe costs: Hardware leasing, licensing, and maintenance rise year-over-year, while cloud is elastic and consumption-based.
COBOL and PL/I skill shortage: The talent pool shrinks as experienced developers retire.
Batch processing limits: Nightly batch windows can’t meet real-time business and customer needs.
Constrained innovation: Monolithic architectures make it hard to adopt cloud-native services, ML, and generative AI.

This post describes a data-first approach that combines Qlik’s CDC with AWS agentic AI services for an incremental mainframe-to-AWS migration path.

Qlik and AWS Transform: a data-first modernization approach

This approach pairs data modernization with application modernization, using the strangler-fig pattern to progressively replace mainframe functions with cloud-native equivalents while existing systems keep running. Rather than a single cutover, new and legacy applications coexist, with data flowing between them until migration completes.

AWS Transform orchestrates the application modernization work. As an agentic AI service, it deploys AI agents to analyze mainframe codebases (COBOL, PL/I, JCL), generate technical documentation, map dependencies, and Kiro then reimagines legacy applications into cloud-native microservices.

With Qlik Data Integration, you can perform CDC of Db2 tables and dependencies that AWS Transform identifies. This maintains a synchronized copy of mainframe data on AWS that modernized applications can consume before migration is complete. Qlik Replicate and Qlik Enterprise Manager are components of Qlik Data Integration.

With these capabilities, you can follow a blue/green migration model. The mainframe remains the system of record while modernized applications are built, tested, and validated against live AWS data. Traffic shifts module by module until the mainframe is decommissioned.

Blue/green cutover. Each wave follows a blue/green pattern at the module level. The mainframe (blue) stays the system of record while the modernized service (green) runs in parallel on live AWS data kept current by CDC. Once green passes validation (data-parity, functional, and performance checks,) traffic shifts to green incrementally. If a signal regresses, traffic reverts to blue and reverse CDC resyncs any green-side changes, helping to minimize the risk of data loss. The mainframe is decommissioned only after all in-scope modules cut over and clear a defined bake-in period.

Qlik capabilities for mainframe modernization

CDC from transaction logs: loads historical data, then captures real-time changes from transaction logs without querying the mainframe minimizing MIPS impact.
Bi-directional sync (reverse CDC): The support of IBM Db2 for z/OS as a target reduces cutover risk during coexistence.
Composability: APIs and flexible deployment enable programmatic orchestration of replication within the broader pipeline, pairing cleanly with AWS Transform.
Target compatibility (1:1 or 1:N fan-out replication): Replicates a single source table to multiple AWS targets at once – Amazon Relational Database Service (Amazon RDS), Amazon Aurora, Amazon Redshift, Amazon Simple Storage Service (Amazon S3), Qlik Open Lakehouse. Each target receives automated schema creation and datatype mapping, column selections, row-level filter conditions and in-table transformations to mask sensitive data or standardize format types.
Data Quality and Trust: Qlik Trust Score aggregates multiple metrics into a single, intuitive score, and governed Data Products deliver lineage-tracked datasets with defined quality checks.
Analytics and AI: Migration data flows into Qlik Cloud Analytics through the Qlik Analytics Engine, powering live dashboards for data exploration. Users query this data in natural language via both Qlik Answers, Qlik’s agentic AI assistant, and through the Qlik MCP Server’s integration with Amazon Quick.

Architecture overview

The reference architecture is modular and composable, allowing organizations to adopt its components independently based on their modernization priorities, and includes the following components:

AWS Transform: Analyzes the mainframe codebases (COBOL, PL/I, JCL), generates technical documentation, maps module-to-table dependencies, and refactors applications into cloud-native services.
Qlik Replicate: Streams mainframe data (Db2, IMS DB) to Amazon RDS and other AWS targets using CDC from transaction logs.
Qlik Enterprise Manager: Configures, runs, and monitors replication tasks across the migration landscape, and provides APIs for programmatic task management.
Kiro: AI-powered IDE for forward engineering that translates the microservice specifications generated by AWS Transform into deployable code.
AWS Lambda and Amazon Bedrock: Orchestrate the replication lifecycle using generative AI, and convert AWS Transform dependency reports into Qlik API payloads.
Qlik Cloud Analytics: Gives program managers a real-time, trusted view of migration progress and data quality and trust metrics across the migration data.
Amazon Quick (optional): AI assistant, powered by Amazon Bedrock, that queries migration data through the Qlik MCP Server to return natural-language answers.

Each component integrates through defined APIs and event-driven patterns, so teams can start with data replication and add application modernization, analytics, and AI capabilities as the program progresses.

Figure 1: shows the numbered path that traces the migration wave end to end, from mainframe code analysis through data replication to analytics.

Architectural deep dive

Application modernization with AWS Transform and Kiro

The process follows two phases; numbers in parentheses map to the reference architecture diagram’s steps.

Reverse engineering (understand the application): Mainframe source code (COBOL, PL/I, JCL, copybooks) is uploaded to Amazon S3 (1), where AWS Transform agents analyze the codebase to identify program structures, business logic, data flows, and inter-module dependencies (2). The output includes a JSON dependency report, data lineage showing which programs read from and write to each Db2 table, and PDF technical documentation (3).

Forward engineering (build the services): AWS Transform generates microservice specifications based on the decomposition analysis, and Kiro turns these into deployable cloud-native code (4). Developers then review, refine, and deploy the generated services iteratively.

The integration point for data modernization is the Db2 dependency report, a structured output that identifies which tables must be replicated to support each modernized module. This report feeds into the data modernization pipeline to support module-aligned data replication.

Data modernization with Qlik Data Integration

Using the technical documentation of AWS Transform and dependency mapping, teams orchestrate replication programmatically, so it aligns with application migration waves.

Orchestration (AWS Lambda and Amazon Bedrock): An AWS Lambda function reads the Db2 dependency report and triggers the workflow (5). The mappings then pass to Amazon Bedrock (6), which converts them into Qlik Enterprise Manager API payloads, provisioning each wave’s data requirements without manual configuration (7).

Replication (Qlik Enterprise Manager and Qlik Replicate): AWS Lambda invokes Qlik Enterprise Manager APIs (8) to clone a template replication task (9), targeting the Db2 tables from the dependency report. Qlik Replicate then runs a full load from Db2 to Amazon RDS (10), then uses CDC to keep the target synchronized at low latency, applying in-table transformations, column selection, row filtering, and data masking without affecting the source. During coexistence, reverse CDC syncs Amazon RDS changes back to Db2 (11).

Analytics and AI with Qlik Cloud Analytics and Amazon Quick

Monitoring modernization progress

Tracking a modernization program’s health and progress supports risk management, resource allocation, and stakeholder communication. Qlik Cloud Analytics and Amazon Quick report on the state of the migration.

Qlik Trust Score and Data Products

Qlik Data Products are governed data packages that combine replicated mainframe data with quality metrics, lineage tracking, and access controls. Each Data Product carries a Trust Score, a single metric combining completeness, accuracy, validity, and diversity into a trustworthy score. Stakeholders can track data quality at each step of the migration journey.

Qlik Cloud Analytics

Qlik Cloud Analytics combines telemetry from Qlik Enterprise Manager, AWS Transform, and the application layer into a single view (12):

Migration progress: Modules migrated versus forecast and wave completion status.
Velocity: Tables replicated per sprint and CDC latency trends.
Wave breakdown: Current wave composition, dependencies, and risk distribution.
Data quality: Trust Scores across replicated datasets and anomaly detection.

Qlik Answers / Qlik MCP Server with Amazon Quick

These insights can also be consumed through an agentic experience using either Qlik Answers, Qlik’s integrated agentic assistant, or Amazon Quick. Amazon Quick connects to the Qlik MCP Server to run natural-language queries against live migration data. Stakeholders can ask questions such as “How many modules are left in Wave 3?” or “What is the current CDC latency for the customer accounts table?” These queries return live answers and insights powered by the Qlik Analytics Engine.

Representative scenario: a global asset management profile

This illustrative scenario describes a global asset management firm running core record-keeping and transaction processing on IBM Db2 z/OS. Taking a data-first approach, the firm uses Qlik Replicate’s log-based CDC to stream mainframe changes into AWS ahead of any application rewrite. Qlik Replicate runs securely within the customer’s AWS environment, connecting to the on-premises mainframe over a private, encrypted network link with centrally managed credentials. ‘

Representative outcomes after standing up the initial data layer:

Improved cost efficiency by offloading reporting and downstream extract workloads that previously ran as nightly batch jobs against Db2.
Sustained throughput in the millions of rows/hour range, feeding operational data stores and the analytics data lake for near-real-time visibility without querying the mainframe.
No data loss during coexistence.
Near-real-time visibility through live dashboards tracking replication health and data quality, replacing manual, point-in-time status reporting.

Conclusion

Mainframe modernization does not have to be all-or-nothing. Organizations can combine data modernization through log-based CDC with an agentic approach to application modernization. This lets them modernize incrementally, migrating related functionality in dependency-ordered stages while maintaining operational continuity.

Next Steps:

Explore Qlik Data Integration on AWS Marketplace
Explore Qlik MCP Server on AWS Marketplace
Learn more about AWS Transform for mainframe
Learn more about mainframe modernization through the self-paced demo

Partner Spotlight: Qlik

Qlik is an AWS Technology Partner with Agentic AI, Generative AI, Data, and Migration & Modernization Competencies. With Qlik, you can bring proven, real-time data movement to modernization programs – from mainframes, databases, and applications to AWS. Serving more than 30,000 customers worldwide, Qlik delivers trusted data and analytics so organizations can move from data to insight to action.

Contact Qlik | Partner Overview | AWS Marketplace

Autonomous replenishment with Databricks MMF, Genie, and Amazon Quick

Venkatavaradhan Viswanathan — Wed, 04 Nov 2026 23:37:47 +0000

By: Venkatavaradhan Viswanathan, Global Partner Solutions Architect – AWS
By: Ryuta Yoshimatsu, Senior Specialist Solutions Architect – Databricks
By: Antony Prasad Thevaraj, Senior Specialist Solutions Architect – Databricks

Replenishment decisions repeat every planning cycle for every item in the inventory catalog, and in most retail organizations planners still make them by hand. A planner exports the forecast, checks each stock keeping unit (SKU) against what suppliers can ship, and places the orders one line at a time. Pre-trained models now forecast demand across a full catalog with little tuning. What doesn’t scale is the manual work between the forecast and the order, on a catalog refreshed every day.

This post is for supply chain and data leaders deciding whether to automate that step. It covers what manual decisions cost, a pattern that places the routine reorders automatically and escalates only the exceptions, where the pattern fits and where it doesn’t, and the outcome across a full inventory catalog.

The cost of manual last-mile decisions

Every replenishment decision can err in two directions, and the same decision recurs every planning cycle. In perishable categories such as grocery, both errors carry direct cost. Underordering causes stockouts and lost sales, and overordering causes spoilage. The combined cost is large. IHL Group’s 2025 Inventory Distortion Study put it at about $1.73 trillion a year, roughly 6.5 percent of global retail sales. IHL’s 2026 study reports the figure at about $1.7 trillion, or roughly 5 percent of global retail revenue, with out-of-stocks accounting for approximately two-thirds of the total and overstocks the remaining third. For a single SKU on a single day, the cost is small, but across tens of thousands of items refreshed daily, decisions that arrive late or without current supplier data reduce margin through both lost sales and waste.

Most of these decisions are routine and follow a fixed rule: demand rises, a supplier has stock, the order is placed. That volume consumes most of the planner’s time while drawing on little of the expertise they were hired for. The decisions that genuinely need a person are the exceptions, such as when no supplier can cover the demand or the spend crosses an approval threshold. Today, those exceptions sit in the same queue as the routine cases and receive the same slow, manual handling. Separating the two is the opportunity.

A pattern for automating routine reorders

The idea is straightforward: let the forecast trigger the order in the routine cases and involve a person only when the situation is genuinely an exception. Databricks produces the forecast. The Databricks Many Model Forecasting (MMF) solution accelerator runs Chronos-2, an open-source, pre-trained forecasting model from Amazon, across the full catalog. Chronos-2 needs no per-item training and can factor in drivers such as promotions and holidays, so one model covers every product. A Databricks Genie Agent then flags the products about to surge. Someone in the business can ask, in plain language, which products are about to surge, instead of writing SQL. Amazon Quick acts on it. It checks each flagged product against supplier availability in Amazon S3 Tables, a capability of Amazon Simple Storage Service (Amazon S3), and a scheduled Amazon Quick Flows automation places the routine orders and escalates the rest. The forecast and the supplier data stay in their own systems.

The following figure shows how the replenishment loop runs in day-to-day business operations.

Figure 1 – How a replenishment decision moves from forecast to placed order: routine reorders are placed automatically, and only the exceptions reach a planner

For the step-by-step build and its design choices, see the companion post on the Amazon Web Services (AWS) Machine Learning Blog.

Where it fits and where it doesn’t

Reach for this pattern when three conditions hold at one time: the authoritative data lives in your data environment, the people who must act on it don’t work inside that environment, and the decision requires information from more than one system. We focus on replenishment in this post, but the same pattern appears wherever the authoritative data and the people who act on it sit in different systems.

It’s equally important to state where the pattern is the wrong tool. When a decision turns on judgment that no rule can capture, such as splitting scarce stock across regions that are all short, the system should surface the options and stop there. A scheduled automation is also too slow when the answer has to be returned in milliseconds. The pattern pays off in one specific case: where a clear rule handles the ordinary decisions and people are freed to spend their time on the rest.

The business outcome

The result is replenishment that runs from forecast to placed order without anyone signing into a console, writing SQL, or switching between tools. The scale is straightforward to estimate. Consider a 50,000-SKU catalog refreshed daily. If roughly 80 percent of the reorder decisions are routine, the loop settles on the order of 40,000 lines per day on its own. The planner’s workload drops from the full catalog to the remaining exceptions that require human judgment. These are illustrative figures, not measured pilot results.

Because none of these components are specific to grocery or to supply chain, the same pattern is a repeatable way to turn a prediction into action across the business. It applies to other high-volume decision cycles, such as the financial close, field-service dispatch, and fraud triage, wherever a prediction and the action it implies are separated across systems and roles.

Learn more

For the full technical build, including the architecture, the approach to scaling, and a complete reference implementation, visit the companion code repository on GitHub. For how the forecasts themselves are produced at scale, read the Databricks companion post, Forecasting at the speed of modern retail. To put the pattern to work, start from the step-by-step walkthrough and engage your AWS or Databricks account team to scope a first use case.

Databricks – AWS Partner Spotlight

Databricks is the data and AI company. More than 20,000 organizations worldwide, including adidas, AT&T, Bayer, Block, Mastercard, Rivian, Unilever, and 70 percent of the Fortune 500, rely on the Databricks Data + AI Platform to unify their data, analytics, and AI. Built on an open source foundation, the platform gives teams a practical way to build AI that understands their business context. The platform includes the products Lakebase, Genie, Unity Gateway, Agent Bricks, Lakeflow, Lakehouse, and Unity Catalog. Databricks holds 11 AWS Competencies, including Data & Analytics, Machine Learning, AI, and Retail, and was named an AWS Partner of the Year in seven categories at re:Invent 2025.

Contact Databricks | Partner Overview | AWS Marketplace

Optimize AI Costs with New Relic Cloud Cost Intelligence on AWS

Swatika Gupta — Wed, 04 Nov 2026 22:31:44 +0000

By: Nava Ajay Kanth Kota, Sr. Partner Solutions Architect – AWS
By: Swatika Gupta, Sr. Customer Solutions Manager – AWS
By: Piyush Bhansali, Director, Product Management – New Relic
By: Muthuvelan Swaminathan, Principal Partner Architect – New Relic

Managing AI costs is one of the top challenges for organizations scaling generative AI on AWS. Amazon Bedrock model invocation APIs and AWS Cost and Usage Reports deliver the granular billing telemetry needed for scalable AI. New Relic Cloud Cost Intelligence (New Relic CCI) builds on this foundation, embedding cost visibility directly into the observability workflows engineering teams already use. Together, AWS and New Relic allow organizations to shift from opaque AI experimentation to disciplined, ROI-driven AI operations with greater cost accountability.

New Relic has already covered CCI’s general availability (April 28, 2026) and AI cost features. This post focuses on how AWS and New Relic work together: how AWS Cost and Usage Report (CUR 2.0), Amazon Simple Storage Service (Amazon S3), and AWS Trusted Advisor provide the data foundation that New Relic CCI turns into engineering-ready insight for Amazon Bedrock workloads, shown through an illustrative use case.

Introduction

A fundamental change is underway in cloud economics: as generative AI workloads scale on AWS, organizations increasingly need to unify performance monitoring and cost management rather than leave cost intelligence siloed in a separate billing tool. New Relic CCI does this by correlating AWS CUR 2.0 data with New Relic telemetry insights, so teams can attribute AI spend to the applications and decisions that drive it.

Observability-native FinOps brings cost intelligence into engineering workflows, tying token-level spending to the context that drives it: deployments, demand spikes, prompt changes, and model selection.

Why AI workloads challenge traditional cost models

The economics of AI are fundamentally different from traditional cloud computing. Unlike Amazon Elastic Compute Cloud (Amazon EC2), where costs scale predictably with provisioned resources, AI services like Amazon Bedrock feature variable token consumption patterns that complicate traditional forecasting. This is a structural challenge that calls for purpose-built cost intelligence capabilities:

Token-level economics: Costs can vary significantly by model, prompt complexity, and use case, and teams often run multiple large language models (LLMs), which makes comparing price and performance across models difficult.
Scaling outpaces governance: AI adoption outpaces existing budgeting frameworks, and consumption-based pricing introduces variability that can lead to overruns.
Attribution gaps: Tying AI costs to specific applications, teams, or business outcomes is hard.

Without a unified view connecting AI spending to the engineering context behind it, organizations struggle to answer the fundamental question of how to measure and attribute their AI return on investment.

How observability-native FinOps connects cost to context

The premise is straightforward: if your engineering team already uses an observability tool to understand application performance, that same tool should surface cost intelligence, correlated with the performance data that explains it. This helps bridge the disconnect where engineers who drive costs and the billing reports they need, live in separate tools, owned by separate teams. New Relic CCI implements this by embedding cloud cost visibility directly into the observability solution.

This is made possible by the AWS investment in cost transparency. AWS CUR 2.0 delivers detailed, hourly billing data, including token-level metadata for Amazon Bedrock invocations, directly to Amazon S3. AWS Trusted Advisor provides optimization recommendations. Together, these form the data foundation that CCI builds upon.

New Relic CCI delivers four key business outcomes:

Understand where AI spend is going. Token-level cost breakdowns by service, model, and token type give teams immediate visibility into which applications and workloads drive cost, replacing opaque single line items with actionable attribution.
Spot trends before they become budget surprises. Interactive Sankey charts trace cost flows from account to service to resource. Month-over-month analysis and automated anomaly surfacing keep leadership ahead of cost growth.
Act on optimization opportunities by pairing insights from AWS Trusted Advisor (such as resource right-sizing and Savings Plans coverage) with New Relic CCI’s savings analysis.
Help prevent overruns before they happen. Configurable budget thresholds with proactive alerts at customizable utilization levels integrate with existing notification workflows for real-time spend governance.

Additionally, the FinOps Agent, currently in public preview, brings conversational cost intelligence to the New Relic Ask AI interface, allowing teams to query AWS billing and performance data using natural language, such as pinpointing Amazon Bedrock cost drivers or comparing model spend across workloads.

Architecture overview

The following describes how New Relic CCI integrates with AWS billing data to provide AI cost visibility:

Figure 1 – CCI data flow from AWS CUR 2.0 (Amazon S3) through ingestion and cost analysis to actionable insights

The data flow follows four stages:

AWS CUR 2.0 delivers cost and usage data to Amazon S3 with up to hourly granularity
New Relic CCI ingestion retrieves billing data and enriches it with AI metadata (model IDs, token counts)
Cost analysis engine in New Relic CCI segments by service, model, and token type to surface trends
New Relic CCI delivers actionable insights including optimization recommendations, budget alerts, and FinOps Agent intelligence to engineering teams

From cost opacity to cost accountability

Consider a mid-size healthcare enterprise running multiple generative AI applications on Amazon Bedrock. This scenario is illustrative. All figures, including those shown in Figures 2 and 3, are synthetic demo data used to show how New Relic CCI attributes cost, not a real customer deployment.

In healthcare, GenAI costs are driven by token economics, model selection, and the overhead of managing sensitive patient data. Regulated workflows add guardrails such as encryption in transit and audit logging, and costs can escalate quickly without clear attribution. Customers building healthcare workloads on AWS use HIPAA Eligible Services under a Business Associate Agreement (BAA) executed through AWS Artifact; use of HIPAA-eligible services alone does not constitute HIPAA compliance, which is a shared responsibility between AWS and the customer. New Relic CCI analyzes billing and usage data, not patient data.

In a typical deployment, spanning a Patient Triage Bot and Clinical Note Summarizer on Claude models, an internal Code Assistant, and a Patient Education Generator, the engineering team sees only a single “Amazon Bedrock” line item in the AWS bill, making it hard to attribute costs or optimize model selection.

With New Relic CCI, the team can:

Identify cost drivers: The Sankey chart reveals that the Patient Triage Bot is the largest cost driver, consuming 43% of the total Amazon Bedrock spend.
Optimize model selection: Token-level analysis shows many triage queries are routine FAQ lookups that a lighter model (Anthropic Claude Sonnet 4.6 instead of Claude Opus 4.6) can handle, which can reduce costs.
Set team-level budgets: Each application team gets a dedicated budget with At Risk alerts at 80% utilization, so that no single team’s experimentation jeopardizes the organization’s AI investment.
Track optimization impact: Month-over-month trending shows how model-switching recommendations can deliver measurable monthly savings.

The following dashboard views show how New Relic CCI surfaces these insights for AI workloads on AWS. Filtered to AWS, they attribute Amazon Bedrock spend down to the individual Anthropic Claude model and token type, the same model-level visibility that drives the optimization decisions described above:

Figure 2 – CCI AI cost view filtered to AWS, attributing Amazon Bedrock spend across Anthropic Claude models (Opus 4.6, Sonnet 4.5, Sonnet 4.6) with token-level cost and usage breakdowns and daily cost trends. Values are synthetic demo data, not a real customer.

Figure 3 – CCI token-attribution table for AWS, breaking down Amazon Bedrock spend by Anthropic Claude model and token type with total AI cost, cost per 1M tokens, token count, and percentage of spend. Values are synthetic demo data, not a real customer.

Conclusion

For organizations scaling AI workloads, embedding cost intelligence into engineering workflows is key to sustainable growth. With New Relic CCI, teams can correlate token-level visibility with application context, act on optimization recommendations backed by telemetry, and govern Amazon Bedrock budgets in real time. Looking ahead, observability-native FinOps is evolving toward autonomous cost governance and predictive budgeting. Organizations that build this discipline now are better positioned to scale AI confidently.

Explore New Relic CCI on AWS Marketplace to see how observability-native FinOps can work for your AI workloads. To get started, see the New Relic Cloud Cost Intelligence documentation for setup instructions and configuration guides.

New Relic – AWS Partner Spotlight

New Relic is an APN Advanced Technology Partner that has demonstrated technical proficiency and proven customer success with AWS Competencies in Government ISV, DevOps ISV, Retail ISV, Advertising and Marketing Technology Software, Migration and Modernization ISV and Data Software specialized solution areas. Their observability solution helps thousands of organizations optimize cloud performance.

Contact New Relic | Partner Overview | AWS Marketplace

Scaling Regulated AI with Domino on Amazon FSx for NetApp ONTAP

Ben Lin — Tue, 03 Nov 2026 19:36:21 +0000

By: Semion Mazor, Senior Product Marketing Manager – NetApp
By: Alon Goldin, FSxN Product Management – NetApp
By: Vaibhav Dhawan, Principal Field Solutions Architect – Domino Data Lab
By: Ben Lin, Senior Solutions Architect – AWS

Introduction

As AI scales from pilots to enterprise production, data architecture, not the model, becomes the critical governance layer. Model performance still matters, but reliable AI in regulated environments depends on controlling data location, access, and the state behind each run. Data scientists need timely access to approved datasets. Your platform, security, and risk teams need access controls, data-residency boundaries, and reproducibility evidence. Manual copies and one-off processes deliver neither: work slows and unmanaged datasets multiply.

Regulated organizations face requirements for data access, retention, traceability, and transfer, including electronic-record rules for FDA-regulated clinical investigations and GDPR requirements for personal-data transfers. Identity-based access, controlled data placement, and recoverable point-in-time states support these requirements, but no architecture ensures compliance by itself.

Under the AWS Shared Responsibility Model, AWS is responsible for security of the cloud, while customers are responsible for security in the cloud, including configuring and operating controls for their data and workloads. In this post, we share three principles that turn storage choices into governance and operating decisions:

Keep compute close to governed data
Preserve reproducible data states
Scale workloads without full dataset copies

Domino Data Lab is an AWS Partner that develops the Domino Enterprise AI Platform for building, deploying, and governing AI workloads, available in AWS Marketplace. Amazon FSx for NetApp ONTAP is a fully managed AWS storage service that runs NetApp ONTAP file systems in AWS. In this architecture, Domino uses FSx for ONTAP as its shared storage layer.

Why storage matters to AI operations

Most AI projects start small: local datasets, one team’s infrastructure, informal processes. In production, your teams read shared datasets, create checkpoints, generate model artifacts, and revisit prior work after source data changes, and a design built for one job creates queues, redundant copies, and operational overhead as concurrency grows.

In regulated AI, these storage decisions carry governance weight and are hard to retrofit once workloads are in production. Early decisions let you address governance concerns before they become production constraints. The following three principles can guide your approach.

Three principles for regulated AI data architecture

1. Keep compute close to governed data

A single location for every dataset is often impractical: data-residency requirements can keep your authoritative copy in a particular AWS Region or on premises, and transfer time and network costs limit movement. Full dataset transfers for every experiment add delay and create copies that are harder to govern.

A hybrid architecture inverts that decision: you choose compute based on where your approved data resides, and replication and caching policies define and limit any data movement. FSx for ONTAP supports NetApp SnapMirror replication and FlexCache caching between compatible environments, so your platform team maintains defined data boundaries while workloads use AWS compute when appropriate.

Wherever data resides, you still need governed access: for Server Message Block (SMB) workloads, FSx for ONTAP integrates with Microsoft Active Directory Domain Services to support identity-based file access.

Data locality doesn’t require a single environment. Separate authoritative data from temporary data, then track transfer volume, preparation time, and end-to-end runtime to see whether cloud bursting or replication improves results or merely shifts costs elsewhere.

2. Preserve reproducible data states

A model-training run requires more than its code: you must identify the training data, code version, software environment, configuration, and approvals behind it. If the dataset changes without a recoverable point-in-time state, reproduction becomes difficult, and sometimes impossible.

Domino records the project context associated with a run, and point-in-time storage snapshots preserve the corresponding data state. Together, they support model lineage and audit preparation. You still need retention, validation, and change-management controls for your own regulatory obligations.

3. Scale workloads without full dataset copies

Concurrent experiments usually begin from the same training data, and a full copy for every team increases storage consumption, slows provisioning, and obscures the authoritative source. Space-efficient, writable clones let teams branch from a common point-in-time dataset; each clone shares unchanged blocks with its source and consumes capacity only as data changes.

Multiprotocol access removes another class of copies: supported workloads can reach the same FSx for ONTAP data through file interfaces or through Amazon Simple Storage Service (Amazon S3) Access Points attached to FSx for ONTAP volumes, with no separate S3 copy to maintain for a different interface.

Finally, as datasets, checkpoints, and artifacts accumulate, ONTAP deduplication, compression, compaction, and tiering reduce the solid-state drive (SSD) capacity you need. Results vary with data type and access pattern, so measure representative workloads instead of assuming a fixed savings percentage.

How Domino applies the principles on AWS

Domino’s platform design reflects these principles. FSx for ONTAP is the default storage for Domino Cloud, and Domino offers Domino Volumes for NetApp ONTAP for self-hosted deployments. In this architecture, Domino provides project context and workload management, while FSx for ONTAP provides shared storage and ONTAP data-management capabilities. Your platform team configures data placement, access, retention, and automation to your requirements.

In practice, your data scientists access approved data through self-service workflows while your platform team retains governance control: workloads run near approved data, run context pairs with point-in-time states, and concurrent projects get writable, space-efficient clones.

The results are measurable. Domino reports that running Domino Cloud on FSx for ONTAP improved write speeds by 417 percent and read speeds by 94 percent, reducing data-loading times and training delays, and delivered roughly twice the performance of previous configurations. Novartis and Merck (MSD), two regulated life sciences customers, are migrating clinical workflows to FSx for ONTAP with deployments spanning hundreds of volumes across multiple file systems.

Reference architecture and operations

Figure 1 shows a Domino deployment inside an Amazon Virtual Private Cloud (Amazon VPC). User traffic reaches Domino through Elastic Load Balancing, Domino runs on Amazon Elastic Kubernetes Service (Amazon EKS), and Amazon FSx for NetApp ONTAP provides the shared storage layer.

Figure 1 – Domino on Amazon EKS with with Amazon FSx for NetApp ONTAP

The diagram also shows an optional control loop: a customer-defined monitor tracks file-system capacity with Amazon CloudWatch metrics and invokes an AWS Lambda function that adjusts capacity. This automation is not built into Domino or FSx for ONTAP, so your operations team owns thresholds, change management, and failure handling.

Measure outcomes at the workload level

How do you know it’s working? Service-level numbers such as peak throughput and storage capacity won’t tell you whether teams finish work faster, use compute more effectively, or spend less on data movement. Compare the same workload under comparable conditions before and after the change, using these workload-level metrics:

Time to provision an approved dataset for a new project: Shows how quickly teams can begin work without bypassing governance controls.
Storage consumed by full copies, snapshots, and writable clones: Reveals the capacity and cost of each provisioning approach.
Job startup time, end-to-end runtime, and GPU utilization: Indicates whether data access keeps your compute resources productive and shortens completion time.
Time to identify and restore the data state behind a prior run: Captures the effort spent supporting reproducibility and audit requests.
Data transferred between environments and the resulting network cost: Reveals the performance and cost effects of hybrid placement, replication, and caching.

Define the workload, baseline, and measurement period upfront so you can connect infrastructure decisions to delivery speed, cost, utilization, and governance effort.

Conclusion and next steps

As regulated AI expands, storage becomes a core part of your governance system: the layer that determines whether production AI stays controlled, reproducible, and efficient. With Domino lifecycle context, ONTAP data management, and managed AWS infrastructure, you can apply these principles across your production environments today. To get started:

Review Amazon FSx for NetApp ONTAP.
Explore the Domino Data Lab and NetApp integration.
Review the Guidance for Deploying Enterprise Apps with NetApp BlueXP Workload Factory and Amazon FSx for NetApp ONTAP

NetApp – AWS Partner Spotlight

NetApp is an AWS Advanced Tier Partner with the AWS Storage Competency. Amazon FSx for NetApp ONTAP, the fully managed AWS storage

service that runs NetApp ONTAP file systems in AWS, is the shared storage layer in this architecture.

Contact NetApp | Partner Overview | AWS Marketplace

Domino Data Lab – AWS Partner Spotlight

Domino Data Lab provides an Enterprise AI Platform for building, deploying, and governing AI workloads, available in AWS Marketplace.

Domino is a founding member of the AWS Machine Learning Competency Partners, validated since 2017.

Contact Domino Data Lab | Partner Overview | AWS Marketplace

This post was co-authored with NetApp and Domino Data Lab. The content and opinions are those of the third-party authors. AWS is not responsible for the content or accuracy of this post.

Scaling agentic AI for governed banking operations with Apexon and AWS

Hamdy Eed — Mon, 02 Nov 2026 23:07:20 +0000

By: Sandeep Singh, Vertical Head – BFSI – Apexon
By: Sanjoy Ghosh, Principal Architect & VP – BFSI – Apexon
By: Hamdy Eed, Sr. Partner Solutions Architect – AWS
By: Kripa Dixit, Sr. Partner Solutions Architect – AWS

Banking, financial services, and insurance (BFSI) institutions need AI systems that can act autonomously, executing decisions across high-volume workflows at market speed. But autonomy without governance is a nonstarter in an industry defined by regulatory intensity and operational risk.

This post presents an architecture-first perspective on how BFSI organizations can operationalize agentic AI on Amazon Web Services (AWS) with governance built in from the start, not bolted on after deployment. Drawing on the deep BFSI engineering experience of Apexon and the AWS governance and orchestration stack, we outline a practical path from experimentation to enterprise-scale agentic operations.

Why architecture needs to come before autonomy

Generative AI has the potential to deliver $200 billion–$340 billion in new value to banks, according to a McKinsey report. In banking, generative AI has proven useful across customer service, analytics, and internal productivity. Yet most implementations remain bounded; a model produces an insight, and a human decides what happens next. At scale, that dependency becomes the gap between AI’s potential and its realized impact.

Agentic AI addresses this gap. These systems autonomously plan, act, and adapt within defined guardrails, pursuing business outcomes rather than waiting for the next prompt. In some cases, they operate through human decision-makers, in others through downstream systems and guardrails that keep actions bounded without human intervention.Before they adopt agentic capabilities, BFSI leaders must determine how to govern systems that act independently. Every autonomous action must be traceable, every decision boundary enforced, every escalation path auditable. This requires purpose-built cloud architecture for governed autonomy, separating decision-making from execution and enforcing policy at every layer.

AWS architecture for governed agentic AI in BFSI

A governed agentic system in BFSI is built on three architectural layers, each enforcing a different dimension of control.

Intelligence layer

The intelligence layer provides reasoning capabilities for planning, interpretation, and decision-making. Amazon Bedrock provides access to foundation models (FMs) suited for different banking tasks, including summarization, reasoning, and information extraction. Organizations can use Amazon Bedrock AgentCore to build and operate agents at scale with managed runtime environments and session isolation critical for BFSI workloads where agents handling different customers or transactions must be securely separated.

Amazon Bedrock Knowledge Bases ground agent outputs in enterprise data, regulatory documents, policy manuals, and customer records, so decisions are based on authoritative sources rather than model hallucinations. Amazon Bedrock Guardrails enforce policy controls around model behavior, filter sensitive information, and prevents compliance-violating outputs before they reach downstream systems. Agents improve over time by incorporating outcome data into their decision context through short-term and long-term memory, context graphs, and enriched retrieval grounding that reflects evolving business rules, improving accuracy without requiring model retraining.

Orchestration and execution layer

Agentic systems don’t operate in isolation. They coordinate workflows across core banking platforms, payment systems, and compliance engines. AWS Step Functions coordinates multistep agentic workflows with built-in error handling, retries, and human approval gates, essential for regulated processes like credit decisioning or Know Your Customer (KYC) escalation. Amazon EventBridge routes events across banking systems in near real time, triggering agent actions when exceptions or thresholds are met.

AWS Lambda and Amazon API Gateway provide serverless execution with precisely scoped permissions that restrict each agent’s actions to authorized systems and data. Amazon Bedrock AgentCore Observability provides visibility into agent execution, so teams can trace reasoning paths and monitor production performance across complex multi-agent workflows.

Governance, security, and audit layers

Governance is the layer that makes autonomy viable in regulated industries. Amazon Bedrock AgentCore Identity provides verifiable agent identities and credential management for enterprise system interactions; each agent has a distinct, auditable identity, just as human operators do. Policy in Amazon Bedrock AgentCore enforces action-level controls, evaluating agent-tool interactions against defined policies before execution. AWS Identity and Access Management (IAM) manages fine-grained access control, which restricts agents’ access to authorized resources.

AWS CloudTrail creates an immutable audit trail of every agent’s action, which supports regulatory examinations and internal audit. AWS Security Hub and AWS Config continually monitor security posture and configuration compliance, flagging drift or violations in near real time. Well-designed agentic systems operate with clear decision boundaries, escalation rules, and audit trails. Every action is traceable, every outcome reviewable. Human oversight is embedded where risk thresholds demand it, which aligns naturally with BFSI regulatory expectations and the AWS Shared Responsibility Model.

The following diagram illustrates this layered capability model.

Figure 1: Key AWS layers for governed agentic AI in BFSI

Governed agentic patterns in BFSI operations

Across large BFSI institutions, governed agentic patterns emerge across core workflows. In each case, the AWS architecture layers work together to enable autonomy while preserving control.

In customer onboarding, agents coordinate identity verification, risk assessment, and compliance checks across multiple platforms. Straightforward cases progress autonomously with built-in verification against authoritative data sources, whereas complex scenarios escalate with full context and audit trails. One banking client reduced onboarding cycle time by 48 percent for institutional clients while maintaining compliance pass rates. This freed relationship managers to focus on higher-value advisory activities. To learn more, read the Apexon whitepaper.

For document management and credit processing in lending and trade finance, agents classify documents, validate completeness, extract key data, and trigger downstream processing. An agent reviewing a letter of credit validates against Uniform Customs and Practice (UCP) 600 rules and triggers payment instructions within scoped execution boundaries enforced by AWS Lambda and Policy in AgentCore. Discrepancies that exceed risk thresholds escalate with full reasoning captured in CloudTrail. One banking client achieved a 50 percent reduction in manual effort and 95 percent document classification accuracy. You can read about it in the Apexon case study.

For payments and transaction exception handling, AWS EventBridge routes payment events to agents that identify root causes, initiate corrections, and coordinate with downstream systems. Amazon Bedrock AgentCore Observability gives operations teams visibility into how agents resolve exceptions. For one of the top five global payments operators, Apexon integrated a real-time payments platform that reduced processing time by over 50 percent while supporting threefold transaction growth, demonstrating how agentic patterns can scale without compromising controls.

Where Apexon fits in the agentic AI journey

Agentic AI is an engineering challenge, not a model deployment exercise. As an AWS Advanced Tier Services Partner, Apexon brings an engineering-first perspective to agentic AI adoption. We help BFSI organizations design and operationalize agentic systems that deliver measurable business outcomes while maintaining trust. This includes building the data foundations agents depend on, engineering workflows that integrate across platforms and embedding governance mechanisms that help achieve transparency and control. It also includes validating systems through rigorous quality engineering so that autonomy strengthens resilience rather than introducing unintended risk.

Together, Apexon and AWS give BFSI organizations the tools they need to move beyond isolated AI use cases and toward enterprise-grade agentic operations that are practical, scalable, and regulatory-ready.

What BFSI leaders should do next

Agentic AI is a logical extension of generative AI. BFSI leaders should identify processes where decision latency creates operational risk or customer friction. Assess data readiness and integration complexity. Engage partners who understand both BFSI realities and cloud-scale engineering and start small but design for scale. Pilot agentic workflows with clear success metrics and governance, then expand with confidence.

We encourage you to explore the Apexon AI solutions in AWS Marketplace or AWS offerings on the Apexon website.

Closing perspective

The real question for enterprises is how to move from AI that informs to AI that acts without compromising trust, compliance, or control. Agentic AI provides that path. When engineered responsibly and deployed on a secure, scalable cloud foundation such as AWS, organizations can operate with autonomy that matches the speed and complexity of today’s financial services operations.

Apexon brings the combination of capabilities this transition requires. As a digitally native engineering firm with deep BFSI experience across retail banking, lending, mortgage, and payments, Apexon understands the regulatory constraints, legacy system realities, and risk thresholds that define the sector. Governance is part of the design, not added after deployment.

For financial institutions ready to move beyond the ceiling of rules-based automation, Apexon delivers the engineering depth to build AI that acts and the domain experience to help verify it does so responsibly.

Apexon – AWS Partner spotlight

Apexon is an AI-first technology services firm that engineers intelligent enterprises across three interconnected disciplines: domain and strategy, cognitive architecture, and harness engineering. As an AWS Advanced Tier Services Partner, Apexon helps BFSI and other regulated organizations build the data foundations agents depend on, engineer workflows that integrate across enterprise platforms, and embed governance for transparency and control. It designs and operationalizes production-grade agentic AI on AWS across the intelligence, orchestration, and governance layers, validated through rigorous quality engineering so autonomy strengthens resilience rather than introducing risk.

Contact Apexon | Partner Overview | AWS Marketplace

Say Hello to 137 New AWS Competency and MSP Partners Added in October

Nick Paris — Mon, 02 Nov 2026 18:13:54 +0000

By Nick Paris, APN Marketing Manager – AWS Partner Network

The AWS Partner Network (APN) is a global community that leverages Amazon Web Services (AWS) technologies, programs, expertise, and tools to build solutions and provide services for customers.

The APN has more than 130,000 partners from over 200 countries, with 70% headquartered outside of the United States. Together, partners and AWS provide innovative solutions, solve technical challenges, win deals, and deliver greater customer value.

To achieve APN Specializations such as AWS Competency and AWS Managed Service Provider (MSP), organizations must undergo rigorous technical validation and assessment of their AWS solutions and practices.

NEW! AWS Competency Partners

To succeed with cloud adoption in today’s complex IT environment and continue to advance in the future, customers can team up with an AWS Competency Partner.

The AWS Competency Program validates and promotes AWS Partners with demonstrated technical expertise and proven customer success in specialized areas across industries, use cases, and workloads. Guidance from these skilled professionals can lead to better business and bigger results.

Team up with our newest AWS Competency Partners:

AWS AI Competency

ACKstorm by Izertis | EMEA | Agentic AI Consulting Services
ACKstorm by Izertis | EMEA | Generative AI Consulting Services
Altimetrik Corp | NAMER | Agentic AI Consulting Services
Batif Services | APAC | Agentic AI Consulting Services
BSG Partners | APAC | Generative AI Consulting Services
CloudHero | EMEA | Generative AI Consulting Services
Cloudlaya | NAMER | Generative AI Consulting Services
Cloudride | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
CloudZone | EMEA | Agentic AI Consulting Services
Co-Prosperity Information | Japan | Generative AI Consulting Services
Craftech | LATAM | Agentic AI Consulting Services
Cygnet.One | APAC | Agentic AI Consulting Services; Generative AI Consulting Services
Dudobi | EMEA | Agentic AI Consulting Services
F9 INFOTECH | EMEA | Generative AI Consulting Services
Fission Labs | NAMER | Agentic AI Consulting Services
G&P Projetos e Sistemas | LATAM | Generative AI Consulting Services
Glacien | APAC | Agentic AI Consulting Services
GS Neotek | APAC | Agentic AI Consulting Services
Hallmark Global Technologies | NAMER | Agentic AI Consulting Services; Generative AI Consulting Services
HAND Enterprise Solutions | China | Agentic AI Consulting Services; Generative AI Consulting Services
Infimatrix | APAC | Generative AI Consulting Services
Ingeno | NAMER | Generative AI Consulting Services
IT Era | LATAM | Agentic AI Consulting Services
KTM ONE | EMEA | Agentic AI Consulting Services
Matellio | NAMER | Agentic AI Consulting Services
Mechanical Rock | APAC | Generative AI Consulting Services
Meyi Cloud | APAC | Generative AI Consulting Services
Morphlix | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Mytech | LATAM | Generative AI Consulting Services
Nebulane | EMEA | Agentic AI Consulting Services
Nublify | LATAM | Generative AI Consulting Services
Nublit by Domus Global | LATAM | Generative AI Consulting Services
phData | NAMER | Agentic AI Consulting Services
Shri Sai Tech | NAMER | Agentic AI Consulting Services
SUPER CLUSTER IT SOLUTIONS | APAC | Generative AI Consulting Services
SWARM TECH | NAMER | Agentic AI Consulting Services
Tavant | NAMER | Agentic AI Consulting Services
Tiger Analytics | NAMER | Agentic AI Consulting Services
Uvaltra | EMEA | Agentic AI Consulting Services; Generative AI Consulting Services
Virtusie | APAC | Generative AI Consulting Services
Vontech IT | NAMER | Agentic AI Consulting Services
AI-Driven | China | Agentic AI Applications
Cloudgov | NAMER | Generative AI Applications
Cognition AI | NAMER | Agentic AI Tools
DuploCloud | NAMER | Agentic AI Applications; Agentic AI Tools; Generative AI Applications
Finout | NAMER | Agentic AI Tools
Needl.ai | NAMER | Agentic AI Applications; Generative AI Applications
Nexla | NAMER | Agentic AI Tools
Omilia Natural Language Solutions | EMEA | Generative AI Applications
Pcnet Infotech | APAC | Generative AI Applications
Pcnet Infotech | APAC | Agentic AI Applications
S-Cube | EMEA | Agentic AI Applications
Straiker | NAMER | Agentic AI Applications
Union.ai | NAMER | Agentic AI Applications; Agentic AI Tools; Foundation Models and App Development; Generative AI Applications; Infrastructure and Data
Upstage | APAC | Foundation Models and App Development

AWS Cloud Operations Competency

Armakuni | NAMER | Cloud Financial Management; Monitoring & Observability
Criptonube – Myappsoftware | LATAM | Cloud Governance
DataEconomy | NAMER | Cloud Governance
Dedicatted | NAMER | Compliance & Auditing
ElasticScale | EMEA | Cloud Financial Management; Monitoring & Observability; Operations Management
Maximyz Cloud | APAC | Cloud Governance
StableLogic | EMEA | Cloud Financial Management; Cloud Governance
Vontech IT | NAMER | Cloud Governance; Compliance & Auditing; Monitoring & Observability; Operations Management

Consumer Goods Competency

Celigo | NAMER | IT & Digital Transformation

Data Services Competency

27Global | NAMER | Consulting Services
Applify | NAMER | Consulting Services
Business Compass | NAMER | Consulting Services
Horus Technologies | NAMER | Analytics
Zühlke (Zuehlke/Zuhlke) Group | EMEA | Analytics

AWS DevOps Competency

DataEconomy | NAMER | Consulting Services
Descasio | EMEA | Consulting Services

AWS Business Value Realization Competency

Intensity Global Technologies | APAC | Consulting Services
ITGix | EMEA | Consulting Services
Myridius | NAMER | Consulting Services
Zaptoz Technologies | APAC | Consulting Services

AWS Digital Sovereignty Competency

Dedicatted | NAMER | Consulting Services
Devoteam | EMEA | Consulting Services

AWS Financial Competency

Cloudera | NAMER | Banking

AWS Government Competency

Capita | EMEA | Citizen Services

AWS Healthcare Competency

Dedicatted | NAMER | Consulting Services

AWS High Performance Computing Competency

UCit | EMEA | HPC Management

AWS Mainframe Modernization Competency

Ci&T Software | LATAM | Mainframe Workload

AWS Manufacturing and Industrial Competency

Cognitivo AI | LATAM | Smart Manufacturing

AWS Media & Entertainment Competency

CloudKeeper | APAC | Direct to Consumer

AWS Microsoft Workloads Competency

Infosys | APAC | Application Modernization

AWS Migration and Modernization Competency

百盈云创（深圳）科技有限公司 | China | Migration Services
COMPUCLOUD | LATAM | Migration Services
Galactic Network | APAC | Migration Services
KPI Partners | NAMER | Migration Services; Modernization Services
SK | APAC | Modernization Services
Sotatek | APAC | Migration Services; Modernization Services

AWS Resilience Competency

CloudSoftway | EMEA | Resilience Design
Metrodata | APAC | Resilience Recovery
Techpartner Alliance | APAC | Resilience Recovery
AlertD | NAMER | Resilience Operations
HYCU | NAMER | Resilience Recovery

AWS Retail Competency

BigCheese | LATAM | Consulting Services
Cognitivo AI | LATAM | Consulting Services
Strata Analytics Group | NAMER | Consulting Services
Thoughtworks | NAMER | Consulting Services
Docebo | NAMER | Smart Stores

AWS Security Competency

Avahi | NAMER | Identity and Access Management; Threat Detection and Response
AXIOMIO | NAMER | Application Security
BSP Cloud | LATAM | Infrastructure Protection
Chaos Gears | EMEA | AI Security; Identity and Access Management
CloudMates | EMEA | Identity and Access Management
CloudZenia | APAC | Identity and Access Management

AWS Resilience Competency

Nahil Cloud | EMEA | Data Protection; Governance, Risk and Compliance; Identity and Access Management; Infrastructure Protection; Threat Detection and Response
Parsectix | EMEA | Identity and Access Management

AWS Security Competency

AlgoSec | NAMER | Infrastructure Protection
Darwinium Operations | NAMER | Application Security; Infrastructure Protection; Threat Detection and Response

AWS Resilience Competency

Evervault | EMEA | Data Protection

AWS Security Competency

Teleport | NAMER | Identity and Access Management

AWS Small and Medium Business (SMB) Competency

Cloudgenia | LATAM | Small and Medium Business
CloudThat | APAC | Small and Medium Business
Datamellon | EMEA | Small and Medium Business
SUDO Consultants | EMEA | Small and Medium Business
Velocis Systems | APAC | Small and Medium Business
Anti-Pattern | Japan | Small and Medium Business
monday.com | NAMER | Small and Medium Business

AWS Storage Competency

ALGO Cloud Advanced Solutions | EMEA | Consulting Services
Mallow Technologies | APAC | Consulting Services
Stormit | EMEA | Consulting Services

AWS Travel and Hospitality Competency

Ada | NAMER | Digital Customer Engagement

NEW! AWS Managed Service Providers (MSPs)

The AWS Managed Service Provider (MSP) Program validates AWS Partners with a proven track record and experience providing end-to-end AWS solutions to customers at any stage of the cloud journey, including planning and design, building and migration, operations and support, and automation and optimization.

To achieve this level of specialization, AWS MSP Partners must complete an extensive independent audit to ensure business health and technical capabilities meet a high bar, and they must maintain this status through annual audits.

Say hello to our newest AWS MSP Partners:

AWS Managed Service Provider Program

Aeonx Digital | EMEA
Blend | NAMER
CloudArmee | NAMER
Cloudster | LATAM
DG Global Technology | APAC
eMaster | LATAM
Galactic Network | APAC
Intellias | EMEA
IT-Magic | EMEA
NIX | NAMER
Partnerway | NAMER
Metrodata | APAC
SKOPIA DIGITAL | LATAM

More Value, Greater Profitability for AWS Partners

Our mission is to make the AWS Partner Network (APN) with AWS Marketplace your preferred route to market and empower partners to deliver differentiated value to millions of AWS customers, helping you to win more, win bigger, and win faster.

We’re aligning the AWS Partner experience—including programs, incentives, and enablement—around AWS services and the partner business models: business outcome solutions, technology solutions, managed services, services, and resell.

These enhancements provide you with more relevant and prescriptive guidance, where you need it, and in a consistent and predictable manner. Your profitability, along with helping you drive new business, is our number one goal.

In 2026, we’ll continue to ensure that AWS Marketplace and our AWS Partner programs provide demonstrated pathways to success—helping you drive greater customer value and profitability. There’s an exciting journey ahead, and we’re thrilled to be on it together!

Learn how AWS is transforming the partner experience >>

Governing AI agent identity with Amazon Bedrock AgentCore and Saviynt Zuma

John Brunot — Fri, 30 Oct 2026 18:29:56 +0000

By: John Brunot, Partner Solutions Architect – AWS
By: Suresh Sridharan, VP of Product Management – Saviynt

Saviynt

This post shows how to govern AI agent identity across its lifecycle by combining Amazon Bedrock AgentCore with Saviynt Zuma. Across many enterprises, AI agents now route inquiries, summarize documents, query data stores, and call downstream APIs with limited human oversight. Each agent authenticates to systems, holds permissions, and acts on data. This means each one needs governance, just like the human identities in their environment. Most organizations, however, manage agents as application components rather than as governed identities. As a result, security teams cannot answer basic questions: which agents exist, who owns them, what they can access, and whether that access remains appropriate.

Amazon Bedrock AgentCore is an agentic service for building, deploying, and operating agents securely at scale. To support these agents in operating within defined guidelines, Saviynt Zuma adds a governance layer that spans discovery, ownership, runtime authorization, access certification, and lifecycle management. Zuma works with AgentCore to deliver this governance across an agent’s complete lifecycle.

Why agent identities need governance

An agent can be created in seconds, invoke a large and changing set of tools, and autonomously act on behalf of a human user, or delegate actions to another agent. Delegation chains and dynamic tool selection add complexity. Compared with traditional service accounts, they make it harder to reconstruct why an agent took a given action. Two significant issues arise with agents. First, coarse-grained permissions describe what an agent can do at design time, not what it should do in a specific request context. Second, without a registry that records each agent’s owner, purpose, and scope at creation, organizations cannot reliably run access reviews or produce an audit trail. Frameworks such as the EU AI Act, the Digital Operational Resilience Act (DORA), and the Network and Information Security Directive (NIS2) impose risk-management, access-control, and logging duties. These duties apply to autonomous systems by the function they perform. An agent registry supports the inventory, accountability, and audit expectations these frameworks set. Consult your legal and compliance teams to determine which requirements apply to your workloads.

You can address these issues by governing agents as first-class identities, which establishes accountability at creation, enforces least privilege at runtime, and produces the records audits require.

Solution overview

The integration addresses two concerns: the runtime that executes agents and brokers their access, and the governance control plane that manages agent identities over time.

AgentCore includes the following services as part of Amazon Bedrock AgentCore (each can be used independently or together):

Execution and isolation: AgentCore Runtime, a capability of Amazon Bedrock AgentCore, hosts agents in a secure, serverless environment with session isolation.
Identity and access control: Amazon Bedrock AgentCore Identity brokers credentials through corporate identity providers. Amazon Bedrock AgentCore Gateway converts APIs, AWS Lambda functions, and Model Context Protocol (MCP) servers into secure, callable tools. Policy in Amazon Bedrock AgentCore applies deterministic security controls to agent actions.
Catalog and observability: AWS Agent Registry, part of Amazon Bedrock AgentCore, provides a centralized catalog for discovering agents, tools, and MCP servers. Amazon Bedrock AgentCore Observability records execution traces and metrics for each session.

Saviynt Zuma provides the governance control plane through three components:

Discovery: Identifies, on an ongoing basis, AI agents as the central governed entity across AgentCore and other environments. For each agent, it captures the defining metadata: the large language model (LLM) it uses, the MCP servers and tools it connects to, its owner, permissions, and lifecycle state.
Protect: Evaluates each agent action at runtime against identity, context, policy, and intent. Distinguishes whether the agent acts independently, on behalf of a user, or through delegation, and enforces least privilege based on that distinction.
Management: Applies ownership rules, lifecycle controls, access certification campaigns, and policy enforcement. Produces audit evidence spanning the full identity lifecycle from registration through deprovisioning.

The following diagram shows how AgentCore and Zuma interact across a single agent request, from tool call through governance evaluation.

Figure 1 – Request flow architecture of the integration

In this model, AgentCore provides execution, credential brokering, tool connectivity, deterministic policy enforcement at the gateway, and telemetry. Zuma adds the cross-environment identity lifecycle: ownership, intent evaluation, certification, and audit evidence spanning agents on AgentCore and in other environments. Where the layers meet, Policy in AgentCore enforces what a tool call is allowed to do, and Zuma governs whether the identity making it is still accountable, owned, and appropriately entitled.

Managing the agent identity lifecycle

The combined architecture manages an agent through six stages.

1. Registration

When you deploy an agent to AgentCore, Zuma records it in a governed inventory. The connector path discovers deployed agents and registers them through a guided workflow. The API path registers agents directly from a continuous integration and continuous delivery (CI/CD) pipeline and captures owner, purpose, and scope at build time. Either path produces an inventory entry with a named owner.

AgentCore maintains its own agent identity directory and, through AWS Agent Registry, a governed catalog of agents and tools. Zuma enhances that inventory with business ownership, entitlement history, and review state across environments.

2. Provisioning

You grant the agent its entitlements. AgentCore Identity brokers credentials and AgentCore Gateway defines the tools the agent can reach. Zuma records granted access so that later reviews can compare it to actual use.

3. Runtime authorization

Policy in AgentCore enforces deterministic rules, written in Cedar or natural language, that define what each tool call can do. Zuma adds an identity-aware check through a standalone authorization service. Before an agent acts, the service confirms that the agent is registered and its owner is current. It also checks that the agent’s access has been certified and that the request aligns with its approved purpose. Policy in AgentCore controls what a tool call can do; Zuma governs whether the identity making it is still authorized to act. For example, a sales-operations agent authorized to read customer relationship management (CRM) data can summarize an opportunity but be blocked from exporting records. That action falls outside the request’s approved purpose.

4. Posture monitoring

Zuma regularly evaluates the agent inventory for over-privileged agents, access drift, and policy violations. It draws on agent metadata retrieved through AgentCore APIs to compare granted access against each agent’s registered purpose. This shifts access review from periodic snapshots to nearly continuous assessment.

5. Certification

Because each agent has a registered owner, Zuma routes access reviews to that owner and records the outcome.

6. Deprovisioning

When you retire an agent, Zuma removes its entitlements and records the action, closing the lifecycle and preserving the audit trail.

Observability and audit

AgentCore Observability produces execution-level evidence: traces and metrics for each session. Zuma maintains the complementary governance record (each agent’s registered owner, granted access, and review history) correlated to AgentCore agents using metadata retrieved through AgentCore APIs. AgentCore services support Amazon Virtual Private Cloud (Amazon VPC), AWS PrivateLink, AWS CloudFormation, and resource tagging. These provide private connectivity and reproducible infrastructure. AgentCore is in scope for SOC 2, ISO, and CSA STAR compliance programs. For current status, see AWS Services in Scope by Compliance Program. Under the AWS Shared Responsibility Model, AWS is responsible for security of the cloud, and you remain responsible for governing the agents and access you configure in the cloud.

An illustrative enterprise scenario

In a representative scenario, a global manufacturing company deployed a fleet of AgentCore agents to route inquiries, summarize documents, and generate compliance reports. The team could not enumerate which agents reached which data sources. After applying this architecture, the team registered each agent through the API path, so every agent had an owner from first deployment. Zuma flagged a summarization agent with unused write access, and the team removed it. Zuma also blocked an export action outside the reporting agent’s approved purpose. In this scenario, Zuma identifies over-privileged agents and removes unused standing access, and such access-review cycles could shorten from weeks to days. The result: a governed inventory with least-privilege access and an ongoing audit trail.

Considerations

You should register agents at creation rather than discovering them later; discovery alone will miss agents that never trigger a connector scan. You can use API-based registration in your CI/CD pipeline to capture developer identity and ownership at build time. Treat runtime authorization and design-time permissions as complementary: permissions alone do not constrain an agent to its approved purpose. Use Policy in AgentCore for deterministic, low-latency rules at the gateway, and Zuma for identity-aware, intent-based decisions that draw on governance state.

Conclusion

AI agents are identities. Governing them requires the same disciplines that apply to human users and service accounts. Amazon Bedrock AgentCore supplies the runtime and tool-access controls. Saviynt Zuma supplies the governance control plane. Used together, they let teams deploy agents while keeping each one accountable, least privileged, and auditable.

To learn more, review the Amazon Bedrock AgentCore documentation and Saviynt Zuma, or get started with Saviynt in AWS Marketplace. Discuss the reference architecture with your AWS account team or AWS Partner Solutions Architect to assess how it applies to your environment.

Saviynt – AWS Partner Spotlight

Saviynt is an AWS Software Path Differentiated Partner and AWS Security Competency Partner that provides a converged, cloud-native Enterprise Identity Cloud for identity governance and administration (IGA), privileged access management (PAM), and cloud security across human, machine, and AI identities. Saviynt Zuma extends that governance to autonomous AI agents.

Contact Saviynt | Partner Overview | AWS Marketplace

Introducing the AWS Direct Connect Partner Program

Cristian Critelli — Thu, 29 Oct 2026 21:37:28 +0000

By: Cristian Critelli, EMEA Lead Networking & Resilience Specialist PSA – AWS
By: Len Gomes, Partner Solutions Architect and AWS Direct Connect Specialist – AWS

When a new AWS Region opens, customers want to connect to it privately from day one. The network partners who can make that happen are often local providers who know the market well but have not yet had the chance to deliver for AWS customers in their locations. Until now, joining the AWS Direct Connect partner network required production customer references up front, so the providers best placed to serve new and emerging markets were often the last to get validated.

Today we’re introducing the AWS Direct Connect Partner Program, which replaces the AWS Direct Connect Service Delivery Program (SDP). The new program does two things the previous one could not. First, it lets partners in new and emerging Regions join on the strength of their technical capability, before they have customer case studies. Second, it adds a dedicated validation track for the AWS European Sovereign Cloud (EUSC), so customers with strict sovereignty requirements in Europe can work with validated partners.

In this post, we explain what changed, how the two program tiers work, and how AWS Partners can apply.

Why validated partners matter

AWS Direct Connect gives organizations a private path into AWS that doesn’t depend on the public internet. Most organizations don’t have equipment of their own sitting in an AWS Direct Connect location. Someone has to bridge the distance between their data center or office and the AWS port, and that’s the role partners play.

Partners support customers in two ways. They can carry traffic to and from a Dedicated Connection that the customer orders from AWS, at 1, 10, 100, or 400 Gbps. They can also provision Hosted Connections on their own Interconnects, from 50 Mbps up to 25 Gbps, which gives customers right-sized capacity that is ready in minutes rather than weeks. Hosted Connections are available only through partners, so the quality of the partner capabilities directly shapes the options customers have.

The AWS Direct Connect Partners page lists more than 200 partners across over 130 AWS Direct Connect locations in over 40 countries. Five partners are already listed at the two Berlin locations that serve the AWS European Sovereign Cloud. The new program is designed to keep that growth going in the places where coverage is still thin.

What’s new in the program

The AWS Direct Connect Partner Program keeps the technical bar of its predecessor and changes how partners reach it:

Two-tier validation path: Partners can enter at V1 (Entry Tier) or V2 (Full Program), so partners in new Regions and emerging territories can get started sooner.
Sovereign cloud support: Partners can validate separately for the AWS European Sovereign Cloud partition.
Single self-assessment: Validation uses one self-assessment with clear technical controls and calibration guidance.
No separate FTR gate: The Foundational Technical Review (FTR) is no longer a standalone prerequisite, so there’s one fewer step.

Two tiers for partners at every stage

V1 (Entry Tier)

V1 is designed for partners who can’t yet provide customer case studies, typically in newly launched AWS Regions, new territories, or smaller markets where demand is still building. AWS validates V1 partners on their capability and infrastructure only. Once accepted, V1 partners can provision Hosted Connections up to 500 Mbps.

V2 (Full Program)

V2 is the full validation. It requires two unique customer case studies for deployments that went into production within the previous 24 months. V2 partners can provision Hosted Connections up to 25 Gbps and receive all program benefits, including badging, a listing on the partners page, and marketing support.

Partners that already have qualifying case studies can apply for V2 directly. Others can join at V1 and apply for V2 after they deliver connections for two unique customers, reusing their existing self-assessment. Table 1 summarizes the differences between the two tiers.

Requirement	V1 (Entry Tier)	V2 (Full Program)
Case studies	Not required (written justification)	2 unique customer references (within 24 months)
Technical validation	Required	Required
Hosted Connection access	Up to 500 Mbps (capacity letter H)	Full access: H, G, and F (up to 25 Gbps)
Program benefits	Partner page listing	Full (badging, listing, marketing support)

Table 1 – Comparison of the V1 and V2 program tiers.

The capacity letters in Table 1 match the symbols used on the AWS Direct Connect Partners page. Table 2 shows the Hosted Connection range each letter represents.

Letter	Hosted Connection capacity
H	50 Mbps to 500 Mbps (V1 and V2)
G	50 Mbps to 10 Gbps (V2 default)
F	50 Mbps to 25 Gbps (V2, requires 100G Interconnect capability)

Table 2 – Capacity letters and their Hosted Connection ranges.

Validated partners for the AWS European Sovereign Cloud

Organizations in the public sector and regulated industries across Europe increasingly need to keep both their data and their operations within the EU. The AWS European Sovereign Cloud is built for those requirements, and the AWS Direct Connect Partner Program now includes a dedicated validation track for it.

To validate for EUSC, partners must:

Create a separate AWS account for the EUSC partition, operated independently of their commercial partition accounts.
Meet the technical requirements (DXE-001 through DXE-006 and DXC-001) independently for EUSC operations.
Confirm which AWS Direct Connect locations in the EUSC Region they will operate in.

EUSC validation is optional and complements validation in the commercial partition. Partners interested in EUSC should contact their Partner Development Manager (PDM) or Partner Solutions Architect (PSA) for onboarding steps.

What partners are validated on

Every partner in the program completes a service-specific technical validation with AWS Partner Solutions Architects. All partners are validated on DXE-001 through DXE-006, and V2 partners are also validated on DXC-001. Customers can use these controls as a checklist of what to expect from a validated partner:

Sales engagement (DXE-001): Clear ways for customers to reach the partner, and a public presence describing its AWS Direct Connect services.
Support process (DXE-002): Documented escalation procedures and response-time commitments.
Resiliency architecture (DXE-003): Infrastructure that supports all AWS Direct Connect resiliency categories without single points of failure.
Location coverage (DXE-004): The specific AWS Direct Connect locations where the partner meets requirements.
Hosted Connection support (DXE-005): A dedicated AWS account for Interconnect management, with Business-level support or higher.
Service requirements (DXE-006): Agreement to meet the AWS Direct Connect Partner Guide requirements.
Connection delivery capability (DXC-001): Customer examples showing connections the partner has delivered at an AWS Direct Connect location, either a Dedicated Connection with the partner providing the cross connect and last mile, or a Hosted Connection on the partner’s own Interconnect. DXC-001 applies at V2; V1 partners complete it when they apply for V2.

Become an AWS Direct Connect Partner

Whether you operate in an established market or in a Region that has just opened, there is now a path into the program that fits where you are today. To apply:

Review the AWS Direct Connect Partner Guide v4.0 and the program validation checklist, both available in AWS Partner Central.
Complete the self-assessment spreadsheet, also available in AWS Partner Central, addressing each technical control.
Submit your application in AWS Partner Central with the completed self-assessment and your architecture diagrams.

Current Service Delivery Program partners and anyone with questions about eligibility should contact their PDM or PSA. Customers looking for a partner can browse the AWS Direct Connect Partners page by location and capacity.

Conclusion

The AWS Direct Connect Partner Program gives network partners a clearer path to validation. With the V1 Entry Tier, partners in new and emerging Regions can join on the strength of their technical capability and move up to V2 as they win customers. The dedicated EUSC track brings validated partners to customers with strict sovereignty requirements in Europe, and a single self-assessment with no separate FTR gate simplifies the process.

If you’re an AWS Partner delivering connectivity to AWS, review the program requirements in AWS Partner Central and submit your self-assessment to get started. If you’re a customer, browse the AWS Direct Connect Partners page to find a validated partner in your location.

Building trusted AI with data and AI governance partners on AWS

Jessica Enzi — Tue, 27 Oct 2026 23:03:14 +0000

By: Jessica Enzi, WW Partner GTM Lead, Data & AI, Governance Strategy – AWS
By: Gitika Vijh, WW Partner Tech Lead, Data & AI – AWS
By: Vitor Freitas, WW Partner Tech Lead, Data & AI – AWS

A consensus is emerging. The next era of trusted AI won’t be defined by who builds the most agents, but by who governs them best. Effective agentic governance means addressing data governance and AI governance and the convergence of the two. Data governance establishes the foundation, providing classification, lineage, quality, and access controls. AI governance provides the oversight layer, which involves agent boundaries, observability, policy enforcement, and bounded autonomy. The order isn’t optional. You can’t govern AI outputs if you haven’t governed the data inputs. Most failed AI deployments trace back to governance gaps that weren’t designed for autonomous systems. Teams build a pilot, then hit a compliance or security blocker.

This scenario isn’t isolated. Adoption is outpacing governance maturity. Only 21% of companies have mature governance models for agents, despite 74% planning to deploy them by 2027 (Deloitte, January 2026). Gartner® takes this further. In Hype Cycle for Data and Analytics Governance (2026, Guido De Simoni, Sally Parker, 4 June 2026), they predict that: “By 2027, 60% of organizations will fail to realize AI value due to a lack of integration between data governance and AI governance.”

The governance challenge is navigational, not technical

Amazon Web Services (AWS) has invested in purpose-built data and AI governance capabilities across both layers. For the data foundation, Amazon SageMaker Catalog provides unified discovery and governance with business glossary and fine-grained access controls, while AWS Lake Formation enforces access at column and row level. AWS Glue Data Quality generates automated rule recommendations and validates them. Serving as the centralized metadata repository across your data estate, AWS Glue Data Catalog now supports business context enrichment and semantic search (preview) so agents can discover data by meaning rather than schema alone. For agent oversight, Amazon Bedrock Guardrails offers content safety, personal identifiable information (PII) redaction, and Automated Reasoning checks with mathematically verifiable policy compliance. Amazon Bedrock AgentCore includes Policy for enforcement of governance rules (using Cedar policy language) and Evaluations for automated agent quality assessment. AWS Agent Registry adds governed agent discovery.

The toolkit is significant. But for customers, the challenge is knowing how to connect the services into a strategy that satisfies legal, compliance, and security teams while keeping projects moving. Customers face three interrelated governance gaps for agentic systems: awareness, action, and trust. The awareness gap is closing because most customers now know governance is critical. However, the action gap remains; customers often don’t know how to operationalize these new governance requirements. The trust gap is hardest to solve because customers need confidence that their governance posture supports production scale. Partners who solve the action gap bridge the trust gap. When using accelerators to do so, they can compress months of trial and error into weeks of production-ready implementation. Governance embedded from the start becomes a force multiplier.

Solving the action gap with the GEAR initiative

Governance Enabling Agentic Readiness (GEAR) is an AWS initiative that identifies and amplifies partners who have built data and AI governance accelerators for AI deployment. A governance accelerator is a partner-built framework or tool that:

Automates manual governance steps
Standardizes repeatable patterns so governance isn’t reinvented
Accelerates implementation timelines by front-loading governance in project planning
Delivers durable governance outcomes that persist beyond the engagement itself

GEAR partners operate across three primary tracks:

Governance of agents – Frameworks and controls for managing AI agents
Governance by agents – AI-powered solutions that automate governance tasks themselves
Practice and industry – Strategies for the people, processes, and regulatory requirements that technical controls alone can’t solve

These tracks reinforce each other. We designed GEAR around a governance adoption cycle, which has four stages. In the first stage, customers establish governance controls over their agents. Trust then builds through audit and oversight. That confidence allows more agents to be deployed at scale. More agents drive demand for more sophisticated controls, feeding the cycle. As deployments grow, organizations also become more likely to need governance by agents. In this fourth stage, enterprises apply agents to select governance tasks to manage the complexity that comes with scale. Not every organization will reach that stage immediately, and human-in-the-loop oversight remains present throughout. But partners who position across both tracks are ready for customers wherever they are in the cycle. The four stages of the governance adoption cycle are shown in the following graphic.

Figure 1: The governance adoption cycle

The first GEAR accelerators

The initial GEAR partners profiled in this section are turning governance uncertainty into structured engagements. They span GEAR’s three tracks, from frameworks that govern agents to AI-powered solutions that streamline governance tasks themselves.

Governance of agents

The first track addresses the governance gap at the agent layer. The partners in this section provide tools for managing agents.

Data Reply AgentOPS governs the full agent lifecycle (design, deployment, monitoring, improvement, and retirement) so controls, audit trails, and guardrails evolve with agents rather than going stale. UK digital bank thinkmoney brought a customer-facing agent to production in 22 weeks, reducing query resolution from 10–15 minutes to under 2 minutes.

DoiT GenAI Governance Accelerator embeds production-grade AI governance (guardrails, access controls, and audit trails) directly into system architecture. For healthcare provider Promptly, DoiT deployed a governed AI solution on Amazon Connect, Amazon Lex, and Amazon Bedrock, compressing a 3–4 month build into weeks and saving about $600K in annual cloud costs.

New Math Data Duet makes human-in-the-loop oversight a first-class control in each agent decision path, combining Cedar policies for role-based access, Amazon Bedrock AgentCore Observability for audit trails, and Amazon Bedrock Guardrails for prompt-injection and PII protection. In 6 weeks, logistics provider Senpex saw 117% more dispatches per dispatcher and 85% faster reassignment, with every decision logged.

Quantiphi Agent Manager deploys and scales multi-agent AI with governance built in. Amazon Bedrock Guardrails, Cedar policies, Amazon CloudWatch, and AWS CloudTrail combine to protect sensitive data, enforce policies, and give end-to-end visibility. See the Utah State Treasurer’s Office success story.

Additional governance of agents accelerators:

Boomi Agent Control Plane – One control plane for agent observability, audit trails, and compliance; governs agents across hybrid environments. Visit Lexitas for their success story.
IBM Enterprise Advantage on AWS – Enterprise-scale AI orchestration to remake workflows with built-in governance and policy controls, including agent-to-enterprise connectivity through A2A and an MCP gateway, end-to-end auditability, and full-stack observability.
PwC – AI security control plane (AWS MP listing pending) with a set of modular accelerators that create a control layer including visibility, governance, and evidence of AI use.
Tata Consultancy Services (TCS) – Agentic AI control plane (AWS MP listing pending) with centralized agent governance with early results showing agent onboarding compressed from 6 weeks to 3 days, 100% policy-compliant.

Governance by agents

The second track turns the equation around: instead of governing agents, these partners deploy agents that perform data governance tasks.

Data Reply Agentic AI for Data Foundations deploys six specialized agents, each with one governance job (profiling, remediation recommendations, validation, data modeling, lineage mapping, and policy enforcement), automating work that typically requires people. For YouGov Sport, it delivered row-level security and auditable lineage across 3.2 billion records from 17 systems in 11 weeks.

Atlan acts as the Context Layer for AI across Amazon Simple Storage Service (Amazon S3), Amazon Redshift, AWS Glue, and Amazon SageMaker. Its Context Agents translate metadata into organizational knowledge, allowing every agent to reason from one shared company brain. To read two success stories, visit How Enterprises Make AWS Data AI-Ready with Atlan.

The Precisely Data Integrity Suite runs AI agents on AWS to classify data, assess quality, and harmonize it, with no data movement required. Automated classification tags sensitive assets instantly, quality agents build rules, and normalization and standardization close the loop.

Practice and industry

Some governance gaps require expertise, not automation.

Adastra Data Governance Framework & Roadmap Design builds ownership, lineage, and access controls into the foundation. At a Canadian public sector entity, it replaced manual scripts with self-service, access-controlled data products so AI initiatives inherit guardrails by default.

Loka AI Governance Readiness Navigator works backward from the regulatory standard to the AWS implementation, mapping each gap to an owner and deliverable. With their three-phase engagement, customers get audit-ready artifacts and governance package aligned to the applicable standards (EU AI Act, ISO 42001, NIST AI RMF) and AWS controls.

GEAR partners include both consulting and technology partners, spanning Premier and Advanced Tier, with collective competencies across data and analytics, and generative AI and agentic AI. Individual accelerator AWS Marketplace listings are linked throughout.

The following graphic shows the logos of the GEAR accelerators.

Figure 2: Logos of GEAR partners

Conclusion

The current GEAR partners and their accelerators demonstrate that governance doesn’t slow AI down. It’s what gets it to production. The accelerators featured in this post are delivering measurable outcomes, and this is only the first set. Ready to close the governance gaps? Whether you’re a partner with a governance accelerator or a customer experiencing governance uncertainty, AWS is ready to meet you where you are.

For partners: The governance surface area for agentic systems is broad and still expanding, from data quality, lineage, and access governance to decision explainability, AI cost controls, compliance evidence, and purpose limitation. If you’ve built or are building a data or AI governance accelerator that automates manual steps, standardizes repeatable patterns, or compresses implementation timelines, GEAR is where your work gets amplified. Explore GEAR on AWS Partner Central. AWS provides the technical foundation; you bring the customer-facing tools that turn capability into confidence. Ask your partner development manager to nominate you at the GEAR Nomination Form.

For customers: If your AI initiatives are stalling at the action gap (governance matters, but you aren’t sure how to operationalize it), GEAR partners can address this through a structured engagement. If the trust gap is what’s holding back production deployment, these accelerators deliver auditable, durable governance outcomes designed to satisfy legal, compliance, and security concerns. And if awareness is still building across your organization, work with a GEAR partner to establish your governance foundation before scaling agents.

To learn more, refer to Architecting agentic AI for scale and trust from the start on the AWS Partner Network Blog.

GARTNER and HYPE CYCLE are trademarks of Gartner, Inc. and/or its affiliates.

Know Before You Go: An AWS Partner’s Guide to re:Invent 2026

Andrew Somera — Tue, 27 Oct 2026 19:42:14 +0000

By: Andrew Somera, Head of Partner Experiences – AWS

We’re looking forward to bringing you AWS re:Invent 2026! The conference is November 30 – December 4 in Las Vegas, with virtual opportunities to watch keynotes live.

All of us at Amazon Web Services (AWS) are excited to connect with AWS Partners and AWS Marketplace Sellers from around the globe. Whether you’re joining us in Las Vegas or virtually, you’ll have access to groundbreaking announcements, technical sessions, and unparalleled networking opportunities that will help transform your business. To maximize your re:Invent experience, we compiled essential information for our AWS Partner and AWS Marketplace communities.

Reserved seating is available for registered attendees to secure seats in our most popular sessions. Sign in to the attendee portal and visit the event catalog to choose your sessions. To help plan your re:Invent experience, download the AWS Events mobile app, available for both iOS and Android.

Attending re:Invent for the first time? Here are some tips to make the most of your experience:

Wear comfortable shoes. With sessions spread across multiple venues along the Las Vegas Strip, you may be walking an average of 10+ miles a day. Use the complimentary shuttle service between venues to save energy for networking and sessions. Check the re:Invent mobile app for real-time shuttle tracking and plan extra time during peak hours.
Get 50% off voucher for an AWS Certification exam. All in-person re:Invent attendees will receive a 50% discount voucher valid for any AWS Certification exam. The voucher can be used for online-proctored or test center–based exams. Earn your AWS Certification prior to attending re:Invent and enjoy special recognition during the event, including access to the AWS Certified Lounge to recharge and network.
Stay connected—bring chargers for your devices. Visit the AWS Partner Booth in the main Expo for a comfortable space to connect with other Partners and AWS experts while your devices power up.
Stay hydrated. Look for the hydration stations throughout the re:Invent campus and keep a refillable water bottle handy as you move between venues.
Have fun! re:Invent isn’t just about learning, it’s about community, with multiple ways to join the action. Lace up for The re:Invent Run at Allegiant Stadium (run or walk, supporting the Michael J. Fox Foundation for Parkinson’s Research), test your knowledge at Trivia Night with Jeff Barr, take a swing at Byte Club mini golf, get a commemorative tattoo at the on-site studio, make a keepsake at the Bling Bar, collect patches with Get Patch’d, and wrap up an incredible week at re:Play, the official re:Invent party on Thursday night.

AWS Partner Experience at re:Invent

This year’s AWS Partner experience delivers targeted content and activities to help you build innovative solutions, drive successful business outcomes, and create new possibilities with AWS.

You’ll gain practical insights on how to apply AWS technologies to better serve your customers, while learning how the AWS Partner Network (APN) and AWS Marketplace can help you scale and transform your business.

Don’t miss our comprehensive lineup of Partner-focused sessions and technical tracks throughout the week, anchored by the must-attend Partner Keynote with Dr. Ruba Borno on Wednesday, December 2.

Head to the main Expo and visit the Partner Advantage Zone, where you can connect directly with AWS Partners specializing in AI, migration, security, and industry solutions. At the APN Booth, discover strategies to build, market, sell, and grow your business with AWS. Stop by the AWS Marketplace Booth to explore ready-to-deploy software applications that help you innovate, and the Specialized Partner Solutions Booth to connect with AWS-vetted experts across critical use cases, from security to AI. You can also get personalized AWS Partner Central support to make sure you’re prepared to leverage new features.

Take advantage of numerous networking opportunities throughout the week to build meaningful connections with cloud innovators from around the globe.

For important details about health and safety protocols, registration information, and accessibility accommodations, review the re:Invent FAQs.

The Partner Keynote with Dr. Ruba Borno

You’re invited to join Dr. Ruba Borno, Vice President of AWS Specialists & Partners, for The Partner Keynote on Wednesday, December 2, from 3 PM to 4:00 PM PT at the Venetian.

AWS Partners, this one’s for you. You’re powering some of the most impactful transformations happening right now, and AWS is building right alongside you, applying the same agentic innovation to our own partner business to simplify co-selling, funding, and going to market.

This is the single biggest moment partners will have with AWS at re:Invent, where you’ll leave knowing exactly where to invest and what it takes to win in the agentic era.

Join Dr. Ruba Borno and special guests including AWS CEO Matt Garman for the game plan: migrations run by agents with your data plugged in, your expertise embedded into the tools customers already use, new paths to more profitable business models, and a demonstration of AWS Marketplace and Partner Central connecting you to more buyers, faster.

You’ll hear it all from the partners and customers who built something together that neither could have built alone. Don’t miss this.

AWS CEO Keynote with Matt Garman

Join AWS CEO Matt Garman on Tuesday, December 1, from 8:30 AM to 10:30 AM PT for the re:Invent 2026 CEO Keynote as he shares the latest innovations powering the agentic era. From AI infrastructure and inference to data, agent platforms, and the software agents AWS is building, see how AWS gives you the depth, breadth, and integration to build what’s next with new announcements and stories from customers already doing it.

Breakout Sessions and AWS Partner Content

Join us for AWS-led breakout sessions, a cornerstone of the AWS Partner experience (PEX) at re:Invent. These lecture-style sessions, delivered by AWS experts, Customers, and Partners, provide comprehensive insights to accelerate your AWS journey. If you’re attending virtually, breakouts will be available on-demand after the conference. Within the PEX track, you’ll also find AWS Marketplace sessions that share the latest features and techniques to sell your products and services.

To further enrich your learning experience, we offer additional session formats:

Chalk Talks: Interactive whiteboarding sessions with small audiences featuring a short lecture delivered by an AWS expert, followed by in-depth Q&A discussion.
Workshops: Two-hour hands-on sessions where you’ll work in teams or individually to solve real-world problems using AWS services. Bring your laptop to build alongside AWS Partner experts.
Builder Labs: Get real-time guidance from AWS experts while you work within your own AWS sandbox environment.
Code Talks: One-hour, demo-heavy presentations focused on live coding or technical walkthroughs.

➤ Explore AWS Partner-focused (PEX) content in the event catalog. See PEX sessions listed by day below and reserve your seats!

Monday, November 30

PEX303-R – Govern, Bill, and Attribute: The Unit Economics of Production Agents
PEX305-R – Ship Agents You Can Trust: An Agent Evaluation Framework for Partners
PEX309-R – Turbocharge your Agentic Consulting Practice with Agentic Consultants
PEX210 – Delivering Measurable Customer Business Outcomes
PEX313 – AWS Marketplace checkout, your website, your brand
PEX317 – Grow Adoption Where Customers Work with AWS Bedrock and Quick
PEX215 – Intelligent Co-Sell in Action
PEX209 – Agentic-Led Modernization: First Movers’ Winning Formula with AWS Transform
PEX213 – The Economics of an AWS Partner: Revenue, Incentives & AWS Marketplace
PEX211 – The Agentic MSP: How AI Compounds Customer Outcomes at Every Layer

Tuesday, December 1

PEX314 – Align cost with value through outcome-based pricing in AWS Marketplace
PEX318 – Building Managed Security Practices with AWS Security Hub Extended and Partners
PEX307-R – The Agentic MSP: AI Agents & Amazon Bedrock AgentCore in Action
PEX403-R – Powering Your Forward Deployed Engineers with Kiro and AIDLC
PEX301 – Multi-Tenant Agentic Platforms: A Scalable Reference Architecture
PEX310-R – Accelerate Your FDE Journey: The Harness & FDE Delivery Kit
PEX304-R – How to Build Autonomous Enterprise Agents with SOPs using Kiro and Bedrock AgentCore
PEX202 – Go-Live to ROI: How Partners Turn Customer Outcomes into Revenue
PEX204 – Speed Wins: Compress Migration Timelines from Pipeline to Production
PEX401-R – Building a Zero Trust for Agentic AI Practice: A Partner Framework
PEX311-R1 – Agentic AI Governance for Regulated Industries
PEX206 – Agentic Process Transformation at Enterprise Scale

Wednesday, December 2

PEX407-R – Build Composable Agents with the AWS Transform Agent Builder Toolkit
PEX201 – Building Your AI Practice: From Business Model to Partner Revenue
PEX307-R1 – The Agentic MSP: AI Agents & Amazon Bedrock AgentCore in Action
PEX310-R1 – Accelerate Your FDE Journey: The Harness & FDE Delivery Kit
PEX304-R1 – How to Build Autonomous Enterprise Agents with SOPs using Kiro and Bedrock AgentCore
PEX305-R1 – Ship Agents You Can Trust: An Agent Evaluation Framework for Partners
PEX312 – Turn AWS Marketplace listings into self-service buyer journeys
PEX203 – Sell to the AI Buyer, Scale Revenue, and Build Long-Term Value
PEX303-R1 – Govern, Bill, and Attribute: The Unit Economics of Production Agents
PEX309-R1 – Turbocharge your Agentic Consulting Practice with Agentic Consultants
PEX401-R1 – Building a Zero Trust for Agentic AI Practice: A Partner Framework
PEX308 – From Manual to Autonomous: Agentic AWS Partner Growth via Quick & MCP
PEX212 – Agentic Selling: Scaling Revenue through Expertise on Demand
PEX319 – Automate your AWS partnership with a unified agentic operating model
PEX403-R1 – Powering Your Forward Deployed Engineers with Kiro and AIDLC
PEX311-R – Agentic AI Governance for Regulated Industries
PEX406 – Architect, launch, and optimize solutions with AWS Marketplace

Thursday, December 3

PEX205 – AI-Powered Profitability: How Partners Are Winning with AWS
PEX214 – Scale Through Partners: The Partner-Led SMB Growth Engine
PEX407-R1 – Build Composable Agents with the AWS Transform Agent Builder Toolkit
PEX207 – Agentic AI Meets the Line-of-Business Buyer
PEX208 – Scaling ISV Revenue: Accelerating Co-Sell with AWS Marketplace

ISV as a Customer

Beyond building and selling on AWS, re:Invent 2026 offers sessions designed for ISVs adopting AWS AI to transform their own business and products. Whether you’re a founder setting AI strategy, an engineering leader accelerating your teams with coding agents, or an architect building agentic, multi-tenant capabilities into what you ship, you’ll hear from experts and customers and get hands-on experience putting AWS AI to work. The sessions below span business strategy, builder enablement, and go-to-market growth.

Business & strategy (executives)

Monday, November 30

PEX303-R – Govern, Bill, and Attribute: The Unit Economics of Production Agents
WOC101 – Managing Bots, Mentoring Brains: The Future of Hybrid Leadership
IND3340 – AI-driven customer experience with Amaze, Byte by Yum! & Amorepacific
BIZ317-R – Build It or Bring It: Getting AI Agents into CX Faster

Wednesday, December 2

MAM202 – How Deutsche Bahn made 10 years of cloud modernization pay off in AI

Use AWS AI to ship faster (builders)

Monday, November 30

IND374-R – Don’t ban it, broker it: Govern AI coding agents with Amazon Bedrock
DVT329 – How startups ship faster with Kiro
DVT214-S – Claude Keeps Building: How Coding Agents Change Software Development (sponsored by Anthropic)
PEX317 – Grow Adoption Where Customers Work with AWS Bedrock and Quick

Wednesday, December 2

AIM416-R1 – Scale your coding agents beyond the laptop with AgentCore

Friday, December 4

DVT226 – Best practices for working with shared coding agents on your team

Build AI into your own product (curated ISV sessions)

Monday, November 30

ANT430 – Event-driven agents at scale: building agentic AI on Amazon MSK
IND3313 – Core banking agent-ready: From composable to agentic financial services on AWS
DVT337-R1 – Build a SaaS control plane with Kiro specs and Strands multi-tenant constructs
AIM378 – MCP and A2A for SaaS: making your product agent-ready
AIM377 – Agentic platform design engineering: scaling AI agents across the enterprise
ARC331 – SaaS Agents Anywhere: building distributed agentic deployments
COP349 – Build a per-tenant observability stack for Agentic SaaS

Tuesday, December 1

CON344 – Multi-tenant SaaS and agentic apps on Amazon EKS
MAM321-R1 – Refactor your monolith for multi-tenancy and agentic AI in one pass

Wednesday, December 2

STG364 – Storage decisions when you’re building a multi-tenant business
SEC430-R1 – Multi-tenant isolation with IAM: ABAC, session tags, and token vending machines
CON343 – Multi-tenant compute modernization with Amazon EMR on EKS
SEC429-R1 – Tenant-isolated agent memory: one IAM policy for AgentCore Memory
MAM413-R – Move your multi-tenant agents to serverless AgentCore

Thursday, December 3

SEC430-R – Multi-tenant isolation with IAM: ABAC, session tags, and token vending machines (repeat)
DVT337-R – Build a SaaS control plane with Kiro specs and Strands multi-tenant constructs (repeat)
ARC330 – Pitfalls of SaaS: Return of the agent
HMC410 – SaaS Agents Anywhere
AIM214 – How Vanguard uses SageMaker HyperPod from training to inference for custom LLMs
MAM321-R – Refactor your monolith for multi-tenancy and agentic AI in one pass (repeat)

Friday, December 4

SEC429-R – Tenant-isolated agent memory: one IAM policy for AgentCore Memory (repeat)
MAM413-R1 – Move your multi-tenant agents to serverless AgentCore (repeat)

Growing on AWS (GTM & revenue)

Monday, November 30

PEX213 – The Economics of an AWS Partner: Revenue, Incentives & AWS Marketplace

Tuesday, December 1

PEX314 – Align cost with value through outcome-based pricing in AWS Marketplace

Wednesday, December 2

PEX312 – Turn AWS Marketplace listings into self-service buyer journeys

Thursday, December 3

PEX208 – Scaling ISV Revenue: Accelerating Co-Sell with AWS Marketplace

➤ Explore all sessions in the event catalog.

For meeting opportunities and forums for executives, please reach out to your account manager.

Session Spotlight: AI-Powered Profitability: How Partners Are Winning with AWS (PEX205)

Don’t miss this breakout session with Julia Chen, Vice President, AWS Partner Core, and Niraj Nath, Director, AWS Partner Core Delivery.

AI is reshaping Partner economics, and the Partners who win will be those building profitable AI-first businesses. Julia discusses how APN Programs are evolving and how to best leverage programs, from resell to managed services to migrations to business outcomes. She and Niraj will cover how to use incentives, enablement, and tools to deliver the highest ROI. You’ll see how AI-powered differentiation lowers your cost of sales, attracts high-value customers, deepens relationships, and enables innovation at scale, all supported by AWS Marketplace and Partner Services capabilities.

Whether your focus is migration acceleration, generative AI adoption, or global expansion, you’ll leave with a clear investment roadmap and pathways for profitable growth.

➤ Register for the PEX205 session >

AWS Marketplace Buyer Sessions

In addition to PEX sessions for selling in AWS Marketplace, we offer sessions designed for buyers at all levels. Whether you’re new to cloud marketplaces or an existing AWS Marketplace buyer, you’ll hear from experts and customers, and get hands-on experience with AWS Marketplace features.

➤ Here are the AWS Marketplace buyer-focused sessions happening at re:Invent:

Monday, November 30

AIM219 – Agentic commerce: Use AI agents with AWS Marketplace
AIM353 – Full-stack data agents using Box MCP and AWS

Wednesday, December 2

AIM2214 – Accelerating Applications with Data on AWS Marketplace

Thursday, December 3

AIM358 – Build agentic observability workflows with AI tools from AWS Marketplace

Visit Our Booths at the Main Expo

Discover the Partners and AI innovations powering your next breakthrough. The Partner Advantage Zone brings together the AWS Partner Network Booth, AWS Marketplace, Specialized Partner Solutions, New to AWS, and Partners LIVE — all in one destination. Explore real-world integrations and join gamified challenges for a chance to win prizes.

AWS Partner Network Booth

Visit the AWS Partner Network Booth in the Partner Advantage Zone — whether you’re a Partner looking to accelerate your growth or a customer searching for the right Partner to help solve your biggest challenges, start here.

With 10 expert-led kiosks, you choose your path. Want to build? Explore how to launch or expand your practice and solutions on AWS — from agentic and applied AI to migration and modernization, data and analytics, and industry and public sector use cases. Ready to market? Discover new resources to boost your brand visibility and generate demand with AWS. Looking to sell? Learn about co-selling strategies, customer success stories, and how to stand out with AWS Specializations and validated credentials. Want to grow your business? Find Partner programs and ways to expand into SMB and new markets. Have questions? Ask — get one-on-one guidance at the Maximize your partnership kiosk or the Partner Central support desk to take your next step. Meet our AWS Partner Ambassadors—successful leaders passionate about sharing their AWS expertise and success stories. Customers: discover vetted AWS Partners matched to your workload, industry, or use case at any kiosk. And don’t miss the AI Gamechangers innovation wall, showcasing Partner-built AI solutions.

While you’re here, pick up a game card and explore activations across the entire Partner Advantage Zone — collect stamps, connect with experts, and enter to win daily prizes and giveaways.

AWS Marketplace Booth

Join us at the AWS Marketplace booth to connect with experts who can help you grow your business. Whether you’re a software seller or buyer, our team is ready to answer technical questions, provide personalized guidance, and help you explore the latest AWS Marketplace innovations.

New to AWS Marketplace? Our experts will show you how to get started. Already using AWS Marketplace? Discover new ways to optimize your experience and maximize your results. Across our seven expert-led kiosks, you choose your path: get hands-on with buyer and seller demos, dive into technical questions in 1:1s with our experts, and see how AWS Marketplace can accelerate your procurement, co-selling, and growth goals.

Don’t miss our sessions at the mini demo theater, where AWS Marketplace and our partners present throughout the event.

Stop by for technical support and join our new discovery game. Pick up a game card and collect stamps as you explore the pavilion and connect with experts. Complete the game to earn a prize.

Specialized Partner Solutions Booth

The Specialized Partner Solutions booth highlights the value of AWS Specialization Partners, showcasing validated Partner solutions across 12 kiosks: 1/ Enterprise AI Productivity Partners, 2/ Agentic AI & Process Automation Partners, 3/ AI-Driven Software Development Partners, 4/ Modern Data & Governance Partners, 5/ Agentic AI Migration & Modernization, 6/ Security Partners, 7/ AI & Agentic Security Partners, 8/ Governance, Risk, & Compliance Partners, 9/ Amazon Connect Family Partners, 10/ Amazon Connect Customer Partners, 11/ Amazon WorkSpaces Partners, and 12/ AWS Communication Developer Services Partners.

Whatever you’re building, bring your workload to the booth and we’ll match you to an AWS-validated Partner with the exact capabilities you need — AWS Specialization is how we prove a Partner has the technical depth to deliver, so you can engage with confidence. And if you’re a Partner, stop by to learn how to earn or expand a Specialization, what the Competency and Specialization bar requires, and how getting validated puts your solutions in front of customers actively looking for them. Come for demos, one-on-one consultations, and exclusive Partner insights.

AWS Partners LIVE!

Join Partners LIVE! filming in-person from the Partner Advantage Zone at re:Invent (Booth #1686-E) where AWS and AWS Partners come together to tackle today’s most pressing security and AI challenges. This infotainment experience brings exclusive insights, commentary on industry news and real-world examples you can put into action. Expect energy, substance, and straight talk: no sales pitches, no buzzword overload, just pure, unfiltered innovation in action.

Tuesday, December 1

Security Session: 10:00 AM – 1:30 PM
AI Session: 2:30 PM – 6:00 PM

Wednesday, December 2

Security Session: 10:00 AM – 1:30 PM
AI Session: 2:30 PM – 6:00 PM

Thursday, December 3

Security Session: 10:00 AM – 12:30 PM
AI Session: 1:30 PM – 4:00 PM

APJ Partner Experience

For our APJ Partner community, AWS hosts a series of dedicated experiences to help you get maximum value from every day on the ground. From one-of-a-kind experiences that pair immersive, high-energy entertainment and curated hospitality with insightful sessions led by AWS SMEs. Partner executives come together for intimate, high-trust gatherings that enable genuine connection and direct engagement with AWS leaders. Partner technical leaders are invited to join dedicated forums offering an APJ-lens digest of re:Invent’s biggest announcements and service deep-dives, with plenty of room for candid Q&A, networking and conversation.

Within the broader APJ on Tour program, partners are invited to country-level welcome receptions and the APJ Kick Off Party (RSVP in your attendee portal), which sets the tone for the week with networking and entertainment across the region. Throughout re:Invent, the APJ Customer Hub, a dedicated and premium space at the Palazzo Prestige Club Lounge at the Palazzo Hotel within the Venetian, provides a professional home base for meetings, turning the week from a series of sessions into real business conversations. We’d love to see you there, so register your team, explore the sessions, and come ready to build what’s next, together.

EMEA Partner Experience

For our EMEA Partner community, AWS brings a purpose-built regional program to re:Invent 2026, designed to help you get maximum value from every day on the ground, with an EMEA lens on the event’s biggest moments and dedicated regional activation layered throughout the week. Partner executives come together for intimate, high-trust gatherings that enable genuine connection and direct engagement with AWS leaders, alongside dedicated partner roundtables offering an EMEA lens on re:Invent’s biggest announcements, with plenty of room for candid Q&A and conversation. Mid-week, the EMEA Networking Reception (Wednesday, December 2, XS at The Wynn, hosted by Yasmin Carr) brings our partners, customers and AWS leaders together to connect over the week’s momentum. Head to your re:Invent attendee portal, tap “Explore your ancillary invitation,” and RSVP for the EMEA Reception. It only takes a moment, but spots fill up fast, so don’t wait! We look forward to welcoming you. Let’s shape what’s next together.

AWS Public Sector Partners

Kick off an exciting week at the Public Sector Partner Forum on Monday, November 30, from 2 PM to 5 PM PT at the Encore. Join Rishi Bhaskar, Director, Worldwide Public Sector Partner Sales, AWS, and an impressive lineup of guest speakers for an engaging and interactive session. You’ll have an opportunity to hear from our featured guest speaker Ruth Buscombe, Strategist, Formula One, and participate in roundtable conversations with AWS leaders. This is an invite-only event. Interested in attending? Reach out to aws-public-sector-partner-events@amazon.com.

Round out your re:Invent experience by connecting with the AWS Public Sector team and your peers at the Public Sector Partner Appreciation Reception on Wednesday, December 2, 5:30 PM – 7 PM at Beauty & Essex in the Cosmopolitan. Register to attend >

AWS GameDay

Want to participate in a gamified learning event? Interested in testing your AWS knowledge at re:Invent? AWS GameDay challenges participants to use AWS solutions to solve real-world technical problems in a team-based setting.

Unlike traditional workshops, GameDays are open-ended and non-prescriptive to give participants the freedom to explore and think outside the box.

➤ Here is the schedule for AWS GameDay events and sessions:

GHJ303-S – AWS GameDay – Developer Productivity & DevOps ft. Dynatrace
GHJ307-S – AWS GameDay – Cybersecurity & Threat Detection ft. SentinelOne
GHJ306-S – AWS GameDay – Service Reliability & Agentic Remediation ft. Datadog
GHJ302-S – AWS GameDay – Resilience & Disaster Recovery ft. Clumio by Commvault
GHJ301-S – AWS GameDay – Agentic AI & AI Application Monitoring ft. New Relic
GHJ304-S – AWS GameDay – Platform Engineering & Cloud-Native Architecture ft. Red Hat
GHJ305 – AWS GameDay – Application Security & AI-Powered Penetration Testing

No need to find a team, we’ll match you with other attendees at the event. Bring your laptop, your A-game, and get ready for an unforgettable experience that will level up your AWS expertise! Walk-ups welcome.

AWS Training and Certification

This year, AWS Training & Certification is helping partners skill up for what you’re building next — moving from certified to capable — because building an AI-ready practice takes more than credentials; it takes teams that can design, build, and deliver agentic AI for customers. And in 2026 we are offering more ways than ever to get your team there: new microcredentials and FDE (Foundational Domain Expert) credentials you can earn on-site, immersive AI-powered SimuLearns, team-based Jams, hands-on partner bootcamps, and an expanded Certification community experience.

Explore the enhanced partner training in AWS Skill Builder, then make the most of it on the ground. At re:Invent, your team can do far more than browse courses — here is some of what you can experience live on-site in 2026:

Earn microcredentials on-site: sit down in a live re:Invent session, attempt a timed hands-on exam in a real AWS environment, and walk away with a shareable digital badge on Credly, earned right there at the event.
Build in Spotlight SimuLearns, Spotlight Labs, and Bootcamps: join immersive, scenario-based sessions on the show floor where you build and troubleshoot real agentic AI systems with AgentCore, Kiro, and Amazon Quick alongside AWS experts.
Prep for the new AWS Certified AI Business Strategist exam: attend an exam prep session at re:Invent and get exam-ready, a new certification for the leaders scoping and shepherding enterprise AI, not just the engineers building it.
Go hands-on with agentic AI: across the Builder Zone from AI-powered conversation simulations to game-based learning like AWS Cloud Quest and AWS Card Clash.

Start your AWS Skill Builder subscription to unlock exclusive content for your team, including AWS Builder Labs, AWS Jam, and Digital Classroom courses. Visit the Training and Certification kiosk in the Builder Zone for live demos of Skill Builder, including new features like personalized learning paths and Team Skills Planner for team learning admins.

Once you arrive in Las Vegas, there are plenty of opportunities to sharpen your team’s skills and propel your AWS practice forward. Visit the AWS Builder Zone at the main Expo, which brings together AWS Training & Certification, Open Source, and DevEx teams for an integrated developer journey with interactive, hands-on learning stations. In the Arcade Arena in the Builder Zone, practice customer conversations through AI-powered simulations in the AWS Skill Builder Meeting Simulator, and play AWS Card Clash, a strategic card game where players deploy AWS services to build architectures and score points. Connect and network with AWS T&C experts and fellow AWS Certified peers at the AWS Certification Lounge for networking and community building.

Partner Bootcamps

Join us for exclusive, hands-on technical workshops led by AWS experts. These foundational (200-level) to advanced (300-level) bootcamps are designed specifically for AWS Partners. Bring your laptop and get ready for guided, intensive learning experiences. Reserved seating is available and space is limited.

➤ View all Partner Bootcamp sessions in the event catalog.

TNC210 – AWS Partner: Govern AI agents by hacking one first (200-level) — Nov 30 (3:30–5:30 PM); Dec 2 (3:30–5:30 PM)
TNC211 – AWS Partner: Agentic AI workflows for business users on Amazon Quick (200-level) — Nov 30 (1:00–3:00 PM)
TNC212 – AWS Partner: Build the AgentCore agent your demo pretends to be (200-level) — Nov 30 (8:30 AM–12:30 PM); Dec 2 (8:30 AM–12:30 PM)
TNC304 – AWS Partner: Build AI workflows that laugh in the face of disruption (300-level) — Dec 1 (1:00–3:00 PM)
TNC326 – AWS Partner: Ship an AI agent without crossing your fingers (300-level) — Dec 1 (8:30 AM–12:30 PM); Dec 3 (8:30 AM–12:30 PM)
TNC339 – AWS Partner: Your agent can wait. Go fix the app it depends on. (300-level) — Dec 1 (3:30–5:30 PM); Dec 2 (1:00–3:00 PM)

AWS Certification

Connect with fellow AWS certified professionals in our dedicated Certification Lounge at Caesars Forum (Academy 407), open Monday – Thursday 7:30 AM to 5:00 PM. The lounge is open to attendees holding at least one valid AWS Certification and offers networking space, exclusive certification swag, an enamel pin wall, and a space to connect with the AWS certified community.

Certified all 12? Join the Golden Jacket Celebration on Wednesday, December 2 (5:30 – 7:00 PM, Caesars Forum | Academy 407) recognizing professionals who have earned every active AWS Certification.

re:Invent in-person attendees receive a 50% discount on any AWS Certification exam. The discount code is available in the re:Invent Attendee Portal and is valid for online-proctored or test center exams; complete testing by January 31, 2027. Join these certification exam prep sessions onsite to accelerate your AWS Certification readiness:

AWS Escape Room: Exam Prep for AWS Certified Cloud Practitioner (200-level, 120 min)
AWS Escape Room: Exam Prep for AWS Certified AI Practitioner (200-level, 120 min)
AWS Escape Room: Exam Prep for AWS Certified Solutions Architect – Associate (300-level, 180 min)
Validate your hands-on AWS skills & earn a microcredential (300-level, 180 min; BYOD required)

Lightning Talks & Breakouts

Short, high-impact sessions on partner enablement, the certification path, and the proficiency journey:

How T&C Empowers Partners to Build AI-Ready Teams and Drive Customer Impact? (breakout, 60 min, hosted by Brian Henry) — A partner shares their firsthand journey designing AI learning pathways, driving engagement through gamification, and building sustainable certification programs tied to measurable business outcomes. Leave with a concrete action plan to accelerate AI readiness across your teams.
The Amplification Effect: Build Mastery with AI in Your Flow of Work (breakout, 60 min, hosted by Umesh Sampat and Adam Balest) — AI amplifies human capability. Learn a practical framework for using AI as a skills accelerator, with real-world examples and a progression model from proficiency to mastery.

Connect with AWS Ambassadors

With thousands of AWS enthusiasts gathering at re:Invent each year, attendees have often requested new ways to network, discover, and connect. Again this year, we have AWS Ambassadors engaged in PeerTalk, re:Invent’s networking program designed to help facilitate meaningful connections.

AWS Ambassadors are presenting at re:Invent breakouts, chalk talks and workshops, participating at roundtables, and supporting Partners and customers at the APN Booth. We’re proud to recognize the 2026 top AWS Ambassadors from across the world. Congratulations to all of our AWS Ambassadors!

Get Inspired by Our Sponsoring Partners

Through the sponsorship program, partners use re:Invent as their single largest moment of the year to generate pipeline and deepen customer and AWS relationships. Sponsors show up across every surface of the event: staffing booths in the Expo, delivering breakout sessions and lightning talks, and hosting customer and executive meetings both in their premium restaurant venue buyouts and across our various onsite meeting spaces. Many also invest in high-visibility branding and activation moments that define the re:Invent footprint. Sponsors treat re:Invent less as a marketing placement and more as a co-sell and co-marketing engine — converting Expo traffic, content, and curated meetings into pipeline, and using the week to launch, to showcase what they’ve built on AWS, and to carry those relationships well beyond the event. Meet our 2026 AWS re:Invent sponsors >

Stay Connected

Keep up with the latest re:Invent 2026 updates and use the hashtags #reInvent and #AWSPartners to join the conversation:

Read the APN Blog for the latest updates from re:Invent
Follow the AWS Partners page on LinkedIn
Follow @AWS_Partners and @awsmarketplace on X/Twitter
Subscribe to the APN YouTube channel
Join the AWS Partner email list for APN news and events

Mastering automated agent performance evaluations in Amazon Connect Customer

Néstor Gándara — Wed, 21 Oct 2026 21:30:13 +0000

By: Vaividh Yasa, Lead Cloud AI Architect – TEKsystems Global Services
By: Nestor Gandara, Principal Partner SA Leader – AWS

Quality assurance leaders face a difficult choice: How do you guarantee every call meets standards when your team can realistically review only a fraction of them? This gap between visibility and coverage costs organizations millions in missed coaching opportunities and inconsistent customer experiences. Performance evaluations measure how well agents handle interactions from greeting customers professionally and verifying identity to demonstrating empathy and resolving issues on the first call. An agent’s ability to execute these behaviors consistently directly determines whether a customer walks away satisfied or frustrated.Historically, quality assurance has been a manual, labor-intensive effort. A supervisor listens to a recorded call, reviews a checklist of expected behaviors, and scores the agent on each criterion. The challenge is scale: a typical contact center handles thousands of calls per day, but a supervisor can realistically review only a handful. This means most interactions go unevaluated, creating blind spots in performance data and limiting the organization’s ability to coach agents effectively.

Amazon Connect Customer addresses this gap with automated evaluation forms. Amazon Connect Customer offers three distinct automation methods that can score evaluation questions without human intervention: generative AI, which reads the conversation transcript and interprets whether the agent met the criteria; conversational analytics categories, which use rules-based phrase detection to identify specific keywords or phrases; and contact metrics, which pull quantitative data like hold count or call duration directly from the telephony system.

The promise is compelling. You can evaluate every interaction, eliminate subjective inconsistency, and give leaders complete visibility into agent performance. But that promise depends entirely on how well the evaluation form is designed, and this is where most organizations struggle.

The challenge when automation can’t be trusted

A large media and entertainment enterprise came to TEKsystems Global Services (TGS) after investing significant effort in building automated evaluations using the generative AI capabilities in Amazon Connect Customer. They’d followed the approach most organizations take: translate the quality assurance checklist into questions, enable generative AI automation on each one, and iterate until the numbers improve. Despite multiple iterations, their system wasn’t producing results they could trust.

On several critical evaluation questions, automated accuracy (the rate at which the system’s automated answers matched expert human evaluator judgments) was stuck at 66.67 percent. One in three automated answers was wrong. Worse, the system was hallucinating. Generative AI was crediting agents with demonstrating empathy when no empathetic language existed in the conversation and marking behaviors as completed when the transcript contained no supporting evidence. The evaluation forms were also being applied manually to individual contacts, limiting coverage and consuming supervisor time.The system was producing numbers but not producing truth. The team had exhausted the approaches they knew. They brought in TGS as specialists to diagnose the issues and engineer a path forward.

A strategic framework for matching the right method to each question

The assessment revealed that the root cause wasn’t a service limitation. The problem lay in the design. The customer had applied generative AI to every evaluation question regardless of whether the question was subjective or objective, contextual or keyword based. This one-size-fits-all approach meant that straightforward, deterministic checks were being processed through generative AI when more straightforward methods would’ve provided consistent, hallucination-free results.TGS developed a strategic decision methodology that became the foundation of the entire engagement. The most consequential decision in building an automated evaluation form is which automation method you assign to each question:

Generative AI for questions such as evaluating empathy, professionalism, or whether an agent guided the conversation effectively, which require natural language understanding, contextual interpretation, and the ability to recognize intent across many phrasing variations.
Amazon Connect Customer conversational analytics categories for objective, keyword-based behaviors where the agent either said a specific type of phrase or didn’t, such as hold procedures, specific greetings, or identity verification statements. These deliver deterministic accuracy with zero hallucination risk.
Contact metrics for quantitative measurements pulled directly from the telephony system, such as hold count, call duration, or transfer events where no transcript analysis is needed.

The following graphic illustrates these three methods.

Figure 1: Three-method classification framework for automated evaluation accuracy

The most accurate evaluation systems use all three methods in combination, each applied where it delivers the highest confidence. This hybrid approach eliminates the weaknesses of any single method while maximizing the strengths of each.

Design principles that drove the transformation

Four additional design principles proved essential to achieving 100 percent automated accuracy:

Decompose compound questions into atomic units – The customer’s original form bundled multiple behaviors into single questions. A combined question asking whether the agent introduced themselves, identified their team, and helped had only 66.67 percent accuracy. Redesigned as three independent questions, accuracy improved immediately and supervisors could now pinpoint exactly which behavior needed coaching.
Engineer instructions for an AI audience – Instructions written for human evaluators leave too much room for generative AI to interpret and fabricate. Effective instructions include explicit decision logic, qualifying and disqualifying examples, anti-hallucination directives, and clear edge case handling.
Invest in transcription accuracy first – Two of the lowest-performing questions shared a common root cause; generative AI was searching for terms incorrectly transcribed. TGS configured the custom vocabulary feature in Amazon Connect Customer with domain-specific terms, pronunciation hints, and common spoken variations. This single step produced a 15–30 percentage point accuracy improvement on affected questions before changing a single instruction.
Automate evaluation application, not only scoring – TGS configured Amazon Connect Customer rules to automatically apply evaluations to all qualifying interactions, eliminating selection bias, guaranteeing complete coverage, and freeing supervisors to focus on coaching.

Business outcomes

The transformation produced measurable results across key dimensions in quality assurance:

Automated evaluation accuracy went from 66.67 percent on the lowest-performing questions to 100 percent across all evaluation criteria. Every automated answer now matched what a trained human reviewer would conclude from the same call. Hallucinations were completely eliminated.
Coverage moved from manual application on a small subset of interactions to fully automated evaluation of every qualifying contact, giving leaders statistically meaningful data instead of anecdotal impressions.
Coaching specificity improved dramatically. Atomic questions identified which behaviors needed attention per agent, unlocking targeted development plans instead of generic training.
Agent engagement increased as self-service dashboards gave agents ownership of their own performance data, shifting the dynamic from evaluation as surveillance to evaluation as development.
Operational efficiency improved as automated evaluations freed supervisor time for high-value coaching activities instead of manual call reviews.

Principles for automated evaluation success

For organizations considering or currently implementing Amazon Connect Customer automated evaluations, here are proven principles for success:

Match the automation method to the question type – The most accurate systems combine generative AI, conversational analytics categories, and contact metrics applied where it delivers the highest confidence.
Invest in the transcript first – Custom vocabulary is the foundation all automation methods depend on.
Decompose complex questions – One behavior per question produces higher accuracy, better diagnostics, and more actionable coaching.
Automate evaluation application – Rules-based automation guarantees every interaction is assessed, eliminating selection bias.
Build observability infrastructure from the start – Enable continuous measurement, calibration, and refinement as your evaluation system matures.

Conclusion

The difference between a contact center that uses automated evaluation technology and one that achieves automated evaluation excellence is a strategic approach. In this case, the customer had the right technology and the right intent, but they needed specialized expertise to unlock the full potential of their system. This included a classification framework that matches each question to the right automation method, instruction engineering that eliminates hallucinations, and operational automation that guarantees complete coverage.Automation can’t replace thoughtful design but incorporating it into a well-planned system multiplies the effectiveness of the solution. For organizations ready to transform their contact center quality assurance, the path from unreliable automation to trusted, production-ready evaluation begins with understanding that the most consequential decisions are made before the first instruction is written.

As contact centers mature in their use of automated evaluations, the next frontier will be multimodal evaluations that combine voice, tone, and behavioral signals with real-time coaching integration that surfaces insights to supervisors within moments of agent interactions. For quality assurance leaders, this means shifting from retrospective coaching to real-time guidance that catches quality issues before they cascade across customer interactions.

Ready to transform your contact center evaluations? Visit the AWS Partner Network Blog to learn more about how Amazon Connect Customer enhances customer conversations. Learn more about how TGS helps enterprises deploy on Amazon Connect Customer.

TEKsystems Global Services – AWS Partner spotlight

TEKsystems Global Services (TGS) is an AWS Premier Tier Services Partner specializing in cloud transformation, AI-powered automation, and contact center modernization. With deep expertise across Amazon Connect Customer, Amazon Bedrock, and AWS artificial intelligence and machine learning (AI/ML) services, TGS helps enterprises design and implement solutions that deliver measurable business outcomes.

Contact TEKsystems Global Services | Partner Overview | AWS Marketplace

Designing governance-first AI agents with Fenergo using Amazon Bedrock

Richi Pandey — Mon, 12 Oct 2026 17:39:31 +0000

By: Richi Pandey, Technical Account Manager – AWS
By: Evangelos Liatsas, Director of Engineering – Fenergo
By: Bilal Karaduman, Senior Partner Solutions Architect – AWS

Fenergo

In regulated industries, trust transforms AI into a competitive advantage and trust starts with governance. Fenergo designed governance-first AI agents on Amazon Bedrock, helping financial institutions to automate compliance with full traceability and oversight.

Autonomous AI agents can now screen transactions, extract data from unstructured documents, and resolve entities across global deny lists. But in regulated industries like financial services, healthcare, and insurance, capability alone doesn’t drive adoption. Trust does. Earning the trust of your customers requires being accountable for the decisions and actions of AI agents, which requires understanding why they do what they do.

This question shaped the approach Fenergo took to designing AI for financial services compliance. In regulated environments, organizations need visibility into how AI-supported decisions are reached, including the data, rules, and controls involved.

This post explores the Fenergo agentic governance-first approach using Amazon Web Services (AWS) managed services, including Amazon Bedrock, Amazon DynamoDB, Amazon Simple Notification Service (Amazon SNS), Amazon Simple Queue Service (Amazon SQS), and Amazon Timestream for InfluxDB. Amazon Bedrock underpins the architecture with multi-model access, built-in invocation logging, Regional data processing, and guardrails-based content filtering, freeing Fenergo to focus on governance rather than infrastructure.

Why governance matters for agentic AI adoption

Foundation models (FMs) can classify documents, match entities, and evaluate compliance rules with impressive accuracy. But when Fenergo began deploying autonomous agents for financial services clients, accountability, not accuracy, was the blocker.

Compliance officers, risk managers, and regulators don’t ask about accuracy. Instead, they want to know whether you can trace every decision back to the data that informed it, explain a decision in language they understand, and produce tamper-proof audit records years from now if a regulator asks. These aren’t theoretical concerns. They map directly to regulatory expectations across the EU AI Act, NIST AI Risk Management Framework (AI RMF), Singapore MAS FEAT principles, and UK FCA guidance on AI governance.

A governance layer for agentic AI workflows

To address these considerations, Fenergo architected the Agent Operating System (Agent OS), a compliance-first governance layer that sits between autonomous agents and the AWS infrastructure powering them. Agent OS orchestrates agentic AI across financial services workflows that include client onboarding, know your customer (KYC), and transaction monitoring.

Agent OS is designed for multi-tenant software as a service (SaaS) operation on AWS managed services. It gives compliance officers visibility into why an agent made a decision, and the ability to intervene when human judgment is required.

The architecture follows two levels, illustrated in the following graphic. First, every agent action is captured as a structured event, maintained in causal order for a defensible audit trail, and routed to purpose-built storage. Second, a human-led Command Center translates AI outputs into clear business logic, provides full decision provenance, and escalates high-risk exceptions. This delivers 50% faster reviews, 40% improved query speeds, and 100% causal ordering.

Figure 1: Solution architecture

The key insight: governing AI agents requires tracking decision provenance, policy enforcement, and explainability, not merely system health.

Designing AI systems that earn trust

The mental model behind Agent OS follows four principles that apply broadly to organizations building accountable AI systems: event-driven design for traceability, explainability, matching storage to purpose, and model flexibility.

Every agent action, including document classification, screening decision, and rule evaluation, produces a structured event flowing through a multistage governance pipeline. Agents interact through a governed framework that enforces event publication as an architectural requirement, meaning the pipeline can’t be bypassed. Events are published to Amazon SNS First-In-First-Out (FIFO) topics and routed through Amazon SQS FIFO queues, preserving causal ordering for defensible audit trails.

When a compliance officer asks why a screening agent flagged a transaction, they need a human-readable explanation connecting data inputs, compliance rules, and conclusions—not raw JSON. Agent OS uses Amazon Bedrock to synthesize decision context into business-rule language on demand, so explanations reflect the full context of the original decision. Amazon Bedrock processes inference requests within the customer’s selected AWS Regions, supporting data locality and applicable data protection requirements. Its Converse API provides an integration point for accessing supported foundation models, simplifying vendor management.

Different types of compliance data have fundamentally different access patterns, so Agent OS uses a purpose-built storage strategy matched to each. Amazon Timestream for InfluxDB supports time-series analytics such as agent performance trends and anomaly detection. Amazon DynamoDB stores operational compliance records that require fast point queries by entity. Amazon Simple Storage Service (Amazon S3) stores immutable event archives with lifecycle policies that support long-term regulatory retention.

Agent OS runs multiple foundation models through Amazon Bedrock, matching models to workloads based on complexity, latency, and cost. Fenergo uses the Amazon Bedrock Converse API to abstract model selection, enabling swaps without rewriting application logic. A key enabler is Amazon Bedrock Knowledge Bases, which maintains tenant-specific compliance context—regulatory rules, internal policies, and client requirements—without fine-tuning, making each client’s requirements part of the decision-making context at inference time.

The architecture spans five layers, illustrated in the following graphic. Tenant-specific guardrails and compliance rules feed into specialized AI agents handling document extraction, screening, autocompletion, data sourcing, and compliance checks. The unified interface in Amazon Bedrock routes workloads to the optimal foundation model—Claude by Anthropic for document processing, Amazon Nova Pro for high-volume matching, and Llama 3.3 by Meta for binary decisions. A multilayer safety shield enforces content validation and prompt injection prevention, and a secure audit trail maintains causal ordering.

Figure 2: Agent OS architecture overview

Designing human oversight into the workflow

A common misconception is that “human-in-the-loop” means that humans approve every decision. That approach defeats the purpose of automation. The right model is one where humans focus on decisions that genuinely require human judgment, and agents handle routine cases competently and transparently.

Agent OS uses a command center to focus human judgment where it’s needed most, with configurable escalation rules per tenant. For example, when entity screening produces a match above a risk threshold—such as a 94% confidence hit against high-risk geography grounded in Global AML Policy v3.2—the system escalates to a compliance officer rather than automatically approving. Officers can drill into individual decisions, override, request evidence, or approve, all captured in a tamper-proof audit trail. The following graphic illustrates this capability.

Figure 3: The Governance Command Center provides a human-readable explainability interface for rapid audit and human oversight

In a demonstration scenario, a compliance officer asked why the document agent chose articles of incorporation over an operating agreement. The system returned a detailed explanation with confidence scores and pattern matches.

Driving business value and innovation for AWS Partners

Customer expectations in regulated industries are shifting. Enterprise stakeholders want to know whether your AI can do something, but more than that, they want to know if you can prove how the tool did it. The governance blueprints, traceability patterns, and explainability features in this post extend well beyond financial services to healthcare, insurance, and government.

The Fenergo FinCrime OS and AI agents deliver measurable operational improvements and strengthen governance:

Up to 45% shorter periodic review timeframes – AI agents automate data reconciliation, document classification, and screening, so compliance teams can focus on higher-risk exceptions.
72% faster document handling – AI-assisted classification and extraction accelerate the preparation of review-ready client records.
Up to 93% lower operational costs – Automation across siloed systems and manual processes reduces the effort required for repetitive, low-risk activities.

Fenergo FinCrime OS and AI agents also help strengthen governance and oversight. Amazon Bedrock is included within the scope of AWS ISO/IEC 42001:2023 Artificial Intelligence Management System certification.Fenergo combines Amazon Bedrock with other AWS managed services and its own ISO 27001 and SOC 2 Type II certified controls to provide a foundation that can help customers address their data protection obligations under applicable regulations. Customers remain responsible for assessing whether their implementation meets applicable legal and regulatory requirements.

This combination makes governed AI a reality, turning regulatory compliance from a constraint into a competitive advantage. Results are based on measurements by Fenergo and can vary depending on the customer, workflow, data, configuration, and deployment.

Key takeaways for building governed AI systems

This architectural approach provides several patterns that can help organizations strengthen governance in compliance-sensitive environments:

Design governance into the workflow – Prioritizing traceability, explainability, and human oversight can help organizations evaluate AI-supported decisions alongside model accuracy.
Preserve event ordering – Maintaining the sequence of inputs, actions, and decisions can help organizations create clearer and more reviewable audit trails.
Architect for model portability – Using the Amazon Bedrock Converse API can reduce application dependencies on individual foundation models and streamline future model changes.
Treat documentation as a core deliverable – Documenting decision flows, controls, and interventions can help organizations support internal review, audit, and governance processes.

Conclusion

The most powerful AI is AI that people trust. The experience Fenergo had demonstrates that trust is built by designing governance into the architecture from day one, not by bolting it on afterward.

This creates a reinforcing cycle in which traceable, explainable agents earn trust, trust expands use cases, and expanded use cases grow business value. Governance isn’t a constraint—it drives adoption.

To explore the AWS services discussed in this post, visit Amazon Bedrock for enterprise agentic AI applications. To learn more about the principles that underpin this approach, visit ISO/IEC 42001:2023 and Responsible AI: From principles to practice. To learn more about the approach Fenergo took to governed AI for financial services, visit Fenergo.

Fenergo – AWS Partner spotlight

Fenergo is an AWS Partner holding the AWS AI Software Competency and the AWS Financial Services Specialization. Their SaaS platform runs exclusively on AWS and is available in AWS Marketplace, covering KYC, AML compliance, client onboarding, and transaction monitoring for global financial institutions.

Contact Fenergo | Partner Overview | AWS Marketplace

Mission Cloud accelerates data validation with Amazon Bedrock AgentCore

Qiong Zhang — Wed, 07 Oct 2026 20:23:31 +0000

By: Na Yu, Principal AI Solutions Architect – Mission Cloud
By: Cindy Barrientos, Senior GenAI Engineer – Mission Cloud
By: Ryan Ries, Director at AI Solutions – Mission Cloud
By: Qiong Zhang, Senior Partner Solutions Architect – AWS
By: Jonathan Vota, Senior Partner Solutions Architect – AWS

Mission

When a services firm relies on a handful of experts for data validation, every departure takes institutional judgment out the door with it. With experts retiring and tenure shrinking, that knowledge drain is now structural. Expertise has to live in the software layer rather than in headcount, where it compounds instead of churning.

Mission Cloud and Amazon Web Services (AWS) built exactly that for a data migration firm: an AI agent on Amazon Bedrock AgentCore that cut onboarding time for new employees, made expert-level validation independent of who’s staffed, and put smaller engagements within economic reach.

Operational bottlenecks in data validation

A data migration consulting company faced critical operational inefficiencies in its validation processes. The firm’s consultants relied heavily on memorizing complex job configurations and navigating extensive business object templates. This created dependency on a small group of expert practitioners. The validation process often required writing text-to-SQL queries against business databases, but not all team members possessed the technical SQL expertise. These experts were expensive, making it difficult to profitably serve small and midsize clients and putting a hard ceiling on growth.This skill gap slowed the business at every level. Client deliverables stalled as consultants waited for experts to become available, while manual query construction introduced frequent errors. Execution quality varied widely between consultants and engagements, and onboarding new team members stretched to months, placing even more demand on the experts.Frequent process updates and consultant turnover further compounded these challenges. The company needed a solution that could guide consultants through validation workflows. It had to preserve institutional knowledge and support natural language data analysis. The goal was to democratize expertise so the business could serve smaller migrations that were previously too costly.

Solution overview

The goal was to reduce validation cycle time and onboarding duration by replacing manual, expert-dependent processes with guided, AI-assisted workflows that empower consultants to perform at an expert level.The solution is an enterprise chat-based assistant with two specialized agents: a data validation agent that guides consultants through a structured nine-step validation workflow and a text-to-SQL agent that lets nontechnical users query business databases using natural language. A contextual routing layer directs each request to the appropriate agent based on where the consultant is in the application, eliminating the need for intent classification.To deliver this, Mission Cloud took ownership of five key areas:

Architectural design for multi-agent systems
Memory and state management for multi-turn conversations and workflow session restoration
Tooling strategy that balances reusability and development velocity
Security and access controls meeting enterprise governance requirements
Observability and monitoring for operational visibility and continuous improvement

Mission Cloud used Amazon Bedrock AgentCore as the serverless and isolated execution environment. Strands Agents served as the agent framework. Together, they provide scalable orchestration, built-in memory management, observability, and enterprise controls. This combination allowed rapid movement from pilot to production. It also maintained the reliability and governance standards required for enterprise deployment.

Solution benefits

The AI agent solution has delivered measurable business impact, based on the customer’s early production data:

Automated text-to-SQL generation – Consultants can perform SQL-based analysis through natural language at approximately $0.02 per query. Validation execution averages $0.40 per run. Both replace a manual process that previously took days or weeks per cycle.
Significant reduction in onboarding time – New employees onboard faster, guided by the AI agent through validation workflows and equipped with natural language SQL capabilities.
Reduced validation cycles – Consultants complete validation tasks in days instead of weeks or months, eliminating wait times for expert availability and reducing manual configuration effort and construction errors.
Preserved institutional knowledge – Complex validation procedures and business rules are encoded in the agent workflows, protecting against knowledge loss from consultant turnover.
Enhanced consistency – Standardized, AI-guided workflows help maintain consistent execution quality across consultants and client engagements.
Scalable cloud infrastructure –The serverless architecture of Amazon Bedrock AgentCore is designed to automatically scale to handle demand spikes without infrastructure management overhead.

The Mission Cloud approach

Mission Cloud delivered the solution in three phases: discovery and planning, implementation, and production deployment.

Discovery, requirements, and architectural planning

Mission Cloud analyzed the customer’s validation workflows and knowledge transfer protocols to pinpoint operational pain points. Given the aggressive 2–3 month production timeline, the team selected Amazon Bedrock AgentCore to perform the work from pilot to production. Core requirements included:

Text-to-SQL analysis for nontechnical consultants
Multistep file quality validation
Uploaded file recommendations for validation
Conversation management for session monitoring and resumption

Mission Cloud chose contextual routing based on the structured nature of the client’s interface. The application already knew which agent was needed based on the page the user was on, so the user didn’t need to perform an additional large language model (LLM) call to classify intent. This architectural decision eliminated the latency of supervisor decision-making, the complexity of training intent recognition, and the risk of misidentified intent. The team also matched model capability to agent complexity, optimizing cost and performance.

Solution architecture and implementation

Mission Cloud designed and implemented an architecture for production deployment using AWS services. Here’s how the architecture works in practice:

Authenticate using Amazon Cognito – The consultant logs in through Amazon Cognito, which verifies identity and enforces access control.
Access the React frontend – The consultant accesses the React frontend on AWS App Runner, initializing a new session.
Submit a query or request – The consultant submits a request using text input, file upload, or prompt template.
Request is routed to the right agent – The contextual routing layer routes the request to the appropriate specialized agent in the Amazon Bedrock AgentCore runtime: the data validation agent (nine-step validation workflow) or the text-to-SQL agent (querying business objects in PostgreSQL).
Conversation context is maintained – Bedrock AgentCore memory preserves context across turns, allowing natural follow-up questions.
The agent invokes its tools – The agent calls tools, including Amazon Bedrock Knowledge Bases, validation workflows, SQL execution through AWS Lambda, and PostgreSQL data reads.
Response and action – The agent returns formatted results. The consultant reviews the results, updates parameters, saves queries, or accesses Amazon Quick Sight dashboards for deeper analysis.

The following figure shows the end-to-end architecture, from user authentication through agent orchestration to tool invocation.

Figure 1: Enterprise AI agent architecture on AWS

Beyond functionality, the solution embeds safety and governance into every layer of the architecture. Amazon Cognito governs identity and access management for users. This means only authenticated users can reach the agent. The agent requires human review at key checkpoints as it guides users through the workflow. Sessions and validations are logged in PostgreSQL for compliance and troubleshooting. The agent’s write access is scoped to session management, maintaining a clear boundary from business-critical data.AWS Partner solutions architects collaborated closely with the Mission Cloud team, providing architectural guidance that refined the solution design and accelerated production delivery.

AWS Partner solutions architects collaborated closely with the Mission Cloud team, providing architectural guidance that refined the solution design and accelerated production delivery.

Production deployment and optimization

Mission Cloud deployed the solution with comprehensive observability, implementing performance monitoring using Amazon Bedrock AgentCore metrics and Amazon CloudWatch, conversation tracing for debugging and quality assurance, cost tracking by agent and model, and user feedback collection for continuous improvement.

Key lessons learned

The experience Mission Cloud had delivering this solution revealed several critical insights for enterprise AI agent development:

Let context guide architecture – Don’t default to complex supervisor patterns when simpler contextual routing meets your needs. Start simple and evolve as requirements demand.
Prioritize observability from day one – Production AI agents require comprehensive monitoring, tracing, and feedback mechanisms to identify issues and drive continuous improvement.

Conclusion

Moving from pilot to production with enterprise AI agents requires careful architectural decisions and robust state management. It also demands thoughtful tooling strategies and comprehensive observability. Amazon Bedrock AgentCore provides the foundation for production agentic systems, handling infrastructure complexity and freeing teams to focus on business logic and user experience.Organizations exploring agentic AI should start by setting goals for clear business outcomes, choose architectures appropriate to their complexity, and use AWS services to accelerate delivery while maintaining enterprise reliability and governance standards.

To learn more about how you can build production AI systems on AWS, visit AWS Prescriptive Guidance and Mission Cloud.

Mission Cloud – AWS Partner Spotlight

Mission Cloud, a CDW company, is an AWS Premier Tier Services Partner. The company specializes in enterprise AI strategy, implementation, and managed services. Mission Cloud has delivered more than 450 AI engagements on AWS. The company has earned back-to-back recognition as an AWS Generative AI Partner of the Year finalist, the AWS AI Competency, and launch partner status for Amazon Bedrock. Its capabilities span the entire AI adoption journey, from prioritization and architecture through production delivery and ongoing operations.

Contact Mission Cloud | Partner Overview | AWS Marketplace

Continuous AI security with F5 AI Guardrails and AWS Bedrock

Vlad Tyshkov — Thu, 01 Oct 2026 17:50:24 +0000

By: Vlad Tyshkov, Partner Solutions Architect – AWS
By: Mark Toler, Product Marketing Manager – F5
By: Daniel Salzedo, Sr. Solutions Architect – AWS

Threats to AI applications evolve faster than manual defenses can match. According to Gartner^®, enterprise generative AI application infrastructure experienced security events at 29 percent of organizations in the last 12 months. Together, pre-deployment evaluation, continuous testing, and adaptive protection compress the gap-to-fix cycle from weeks to minutes.

Encoded inputs, rephrased queries, and multi-turn prompt chaining bypass static rules and keyword filters. To defend AI applications, you need protection that understands intent, not patterns alone.

F5 AI Guardrails and F5 AI Red Team run with AWS Bedrock and deliver continuous adaptive security for AI applications in production. In this post, we introduce three capabilities your enterprise AI security program needs and explain how F5 addresses them on AWS Bedrock: pre-deployment model evaluation, adversarial testing at scale, and adaptive runtime protection that stays ahead of emerging threats.

Three capabilities for your AI security program

AI application security requires more than content filtering. You need a continuous cycle of evaluation, testing, and adaptation. Here’s why each capability matters.

Evaluate foundation models before deployment

Before you commit to a foundation model (FM), you need visibility into its security profile. Different models respond differently to adversarial inputs. A model that resists prompt injection in one category might be vulnerable in another. Without pre-deployment assessment, you’re committing to guardrail configurations based on assumptions rather than data.

The F5 Comprehensive AI Security Index (CASI) Leaderboard ranks leading AI models based on their resistance to real-world attacks. You can use the leaderboards to compare foundation models available through AWS Bedrock. CASI evaluates models against a database of more than 100,000 test patterns, with more than 10,000 new prompts added monthly. It provides security scores and detailed profiles so you can make model selection decisions based on each model’s actual response to specific test types. Results pinpoint which runtime guardrails to enforce before deployment.

Test at adversarial scale

Manual security reviews cover dozens of scenarios. Automated adversarial testing generates thousands of test variations in hours. The gap matters because sophisticated prompt techniques (encoded inputs, multi-turn chaining, rephrased queries) bypass pattern-matching filters that catch obvious threats. You need testing that adapts like a real threat actor: revising prompts based on responses, backtracking when blocked, and strategizing dynamically.

F5 AI Red Team complements AWS Bedrock by testing your AI applications at this scale. It generates more than 10,000 test variations in 48 hours, conducting multi-turn tests that adapt strategies based on your application’s responses. According to F5, this approach discovers 3–5 times more security gaps than manual reviews. You can trace how each gap was discovered using Agentic Fingerprints, a visualization that maps the full prompt-and-response sequence across every turn of the test. You can use the visualization to understand precisely how security gaps manifest in multistep scenarios.

Evolve defenses faster than threats

Static guardrails degrade over time. New bypass techniques emerge daily. You need runtime protection that blocks known patterns in real time and a mechanism to discover and deploy defenses for new patterns faster than threats evolve. The critical metric is the time from gap discovery to rule deployment in production.

F5 AI Guardrails operates as an inspection layer between your applications and AWS Bedrock, evaluating prompts before they reach the foundation model and responses before they return to your application. Input and output policies operate as separate rule sets, so you can enforce different criteria for each direction. F5 AI Guardrails runs within your own AWS account, so your data doesn’t leave your environment.

When F5 AI Red Team discovers a new gap, its companion capability, AI Remediate, generates a guardrail configuration for your team to review and apply in a single step. You can tailor defenses through a natural language interface without writing code. Production monitoring feeds findings back into red teaming campaigns, creating a continuous improvement cycle.

How F5 and AWS Bedrock Guardrails work together

Both AWS Bedrock Guardrails and F5 AI Guardrails enforce content policies at runtime. AWS Bedrock Guardrails provides strong foundational protection, with capabilities that include content filters, denied topics, word filters, sensitive information filters for personal identifiable information (PII) detection and masking, contextual grounding checks, and Automated Reasoning checks. These address a broad range of known risks and form a solid security baseline for your AI deployments.

Together, AWS Bedrock Guardrails and F5 deliver layered protection: foundational enforcement plus continuous discovery and adaptation. F5 AI Guardrails evaluates prompts and responses in context of the full interaction history, maintaining awareness across the entire conversation. F5 AI Red Team probes your application to surface scenarios that emerge as threats evolve. You set the testing objective in natural language, such as “extract restricted financial data.” The AI agent then determines how to reach that goal across multiple conversation turns. The agent revises its approach when blocked and backtracks to try new paths. You can trace each decision the agent made to reach its goal, giving you the context to evaluate what to change in your defenses. Each test cycle feeds the next, so your protection improves continuously rather than eroding between reviews.

An illustrative scenario in a regulated industry

An organization in a regulated industry, such as financial services or healthcare, might deploy AI models that process sensitive domain-specific information. These organizations need to prevent their AI systems from generating or disclosing restricted content while still providing useful responses to legitimate queries.A common initial approach is keyword filtering to block specific query terms before they reach the model. However, adversarial testing quickly reveals edge cases where rephrased queries bypass these filters. Security teams need protection that understands query intent rather than matching specific prompt terms.

Your AI governance team can create custom guardrails through F5’s natural language interface, blocking both inputs and outputs related to restricted content without AI engineering resources or custom code. According to key findings from F5, F5 AI Guardrails achieved 99.3 percent efficacy against direct prompt injection, 98.7 percent against excessive agency, and 99.0 percent against sensitive data leakage across approximately 20,000 adversarial test cases.

What this means for your organization

When you combine pre-deployment evaluation, adversarial testing at scale, and adaptive runtime protection, you create a security posture that evolves continuously. Data informs your model selection decisions. Security gaps are discovered proactively and defenses updated before they reach production. This lifecycle runs within your existing AWS infrastructure, keeping your security team in control at every step.

Conclusion

AI security requires three continuous capabilities: pre-deployment model evaluation, adversarial testing at scale, and adaptive runtime protection that evolves faster than threats. Organizations that implement all three can reduce the gap between a threat being discovered and deploying a defense from weeks to minutes.To get started:

Review foundation model security profiles using the CASI Leaderboard before you make procurement decisions.
Adopt automated adversarial testing to identify multistep threat sequences that manual reviews miss.
Configure runtime guardrails that block known patterns in real time. When Red Team discovers a new gap, apply updated rules in a single step.

To get started with F5 AI Guardrails and AI Red Team for your AWS Bedrock deployments, contact F5 or explore F5 in AWS Marketplace.

Gartner Press Release, Gartner Survey Reveals GenAI Attacks Are on the Rise, September 22, 2025 GARTNER is a trademark of Gartner, Inc. and/or its affiliates.

F5 – AWS Partner Spotlight

F5 is an AWS Advanced Technology Partner and AWS Security Partner that gives the world’s largest businesses, service providers, governments, and consumer brands the freedom to securely deliver every app, anywhere, with confidence. F5 delivers cloud and security application services that help organizations embrace the infrastructure they choose without sacrificing speed and control. For more information, go to f5.com.

The F5 Application Delivery and Security Platform (ADSP) delivers adaptive security for AI applications, APIs, and data across hybrid multi-cloud environments. F5 AI Red Team, F5 AI Guardrails, and F5 AI Remediate together provide a comprehensive AI security lifecycle, from pre-deployment model evaluation through runtime protection.

Contact F5 | Partner Overview | AWS Marketplace

New FDE Pathways For AWS Partners: Get Ready for Production Agentic AI Delivery

Karthik Sonti — Thu, 01 Oct 2026 15:45:37 +0000

By: Karthik Sonti. Head of Agentic AI, Consulting Partners Growth & Strategy – AWS
By: Erik Farr, Director of Solution Architecture, Consulting Partners Growth & Strategy – AWS
By: Priya Bains, Head of Partner Brand and Content Strategy – AWS

Production agentic AI requires engineering depth that most organizations are still building. On June 30, AWS announced the Forward Deployed Engineering (FDE) organization, backed by a $1 billion investment, and extended this hands-on delivery approach to AWS Partners through the Partner-Led FDE motion. Now, AWS Partners have a structured way to build and validate that depth with three new Partner FDE pathways and credentials that recognize the applied proficiency required to deliver production agentic AI.

Starting today, AWS Partners can access the three FDE pathways at no cost through AWS Skill Builder: Ground, Orchestrate, and Prove. Two credentials, FDE Validated and FDE Advanced, recognize different levels of technical depth. They are earned through hands-on validation in AWS-provisioned environments, not solely through course completion or multiple-choice tests.

Why this matters

Moving agentic AI from demonstration to production requires both a measurable business outcome and the engineering depth to deliver it. The system must connect to authoritative business data, coordinate workflows reliably, recover from failures, and meet enterprise security and governance requirements. These demands span different disciplines, and expecting every engineer to be equally deep in all of them doesn’t scale. Partners who build this depth now will be positioned to meet the demand FDE is designed to serve.

The pathways give partner organizations a structured way to build, assess, and scale this depth. As builders earn credentials and apply these capabilities, reusable connectors, domain ontologies, agent patterns, and operations tooling compound into a stronger delivery practice. That depth matters to customers. Partner FDE credentials provide evidence of what individual builders have demonstrated, and customers can choose the delivery model that fits: first-party AWS FDE, an AWS-led engagement with partner specialists, or Partner-Led FDE.

Three capabilities required for production

A demonstration can show that an agent works once. A production system must do more. Ground, Orchestrate, and Prove divide the production problem into complementary areas of engineering depth:

Pathway	Focus	Production question
Ground	Trusted enterprise data, systems, domain ontologies, and business context	Does the system understand the business and use reliable information?
Orchestrate	Dependable agents, tools, workflows, identity, and recovery	Can the system perform real work reliably?
Prove	Evaluation, observability, security, policy, and human control	Can the customer trust it in production?

These are technical capability pathways, not separate delivery models or fixed job titles. Builders can develop depth in one or more pathways. For customer delivery, partners bring the necessary capabilities together around the problem being solved.

How Partner FDE readiness works

Credential attainment is based on what builders can demonstrate, not what courses they’ve completed. Preparation resources are available but separate from validation. Builders can use them for additional context or proceed directly when ready.

Four steps to earn a credential:

Meet the AWS Certification prerequisite. An active AWS Certification is required for the credential being pursued.
Choose a pathway in AWS Skill Builder. Begin with Ground, Orchestrate, or Prove based on your existing skills and where you want to demonstrate depth.
Complete the required validation. Finish the published validation activities and point requirements in AWS Skill Builder. Activities can include assessments, SimuLearn, microcredentials, and other hands-on work in AWS-provisioned environments.
Accept your badge. A badge is automatically issued upon completion.

The credentials recognize two levels of demonstrated depth:

FDE Validated: Hold an active Associate- or Professional-level AWS Certification, complete every required validation activity in at least one pathway, and earn the required total points across Ground, Orchestrate, and Prove.
FDE Advanced: Hold an active AWS Certified Generative AI Developer – Professional certification and complete the published validation requirements across all three pathways.

Get Started: Access the Partner FDE Technical pathways in AWS Skill Builder to confirm pre-requisites, choose your pathway and begin validation. The live Skill Builder experience is the source of truth for current requirements, recognized prior completions, and credential policies.