Strategic PartnersIssue 027 records
AWS
AWS SLED edition, October 30, 2026. Agent security dominates. Independent Zenity research found that, until late September, one prompt to an exposed Bedrock AgentCore agent could expose credentials, conversations and secrets across an account-region. AWS disputes the framing. Meanwhile, AWS's new guidance says model-only boundaries are not controls, and its CJIS RAG design for municipal police stresses that retrieval filtering is not authorization. GovCloud gained OpenAI GPT-5.6 with cross-Region inference. Kansas City-area counties are using Granicus's Bedrock-based assistant, with modest vendor-reported results and transparency gaps. Virginia Tech and Pitt expanded AWS-backed AI education programs. Five of seven items are vendor or institutional material.
- Evidence records
- 7
- Cross-source patterns
- 2
- Evidence classes
- 5 vendor claim1 independent research1 independent reporting
- Outcomes
- 5 emerging1 cautionary1 mixed
- Source freshness
- 6 new this fortnight1 recent
- Research completed
- 2026-10-31
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
Agent and retrieval boundaries must be enforced outside the model, and vendor defaults verified
Three sources converge from different angles. Independent research showed AgentCore's default execution role let one prompt-injected public agent reach every agent, conversation and secret in its account-region until AWS hardened it by late September. AWS's own 28 Oct guidance now says a boundary that depends only on the model is not a control. AWS's CJIS RAG design warns that ACL-aware retrieval is filtering, not authorization, with revocations cached for up to an hour. All three put deterministic identity, IAM and approval controls ahead of model behavior. The independent item, however, shows the platform defaults themselves needed fixing.
Operating questionFor each agent or RAG pilot, which limits are enforced by IAM, policy or application identity rather than by the model? Have we checked execution roles against current, not assumed, defaults?
Supporting evidenceZenity LabsAWS public sector guidance proposes a 30-minute 'delegation audit' for Bedrock AgentCore agents, insisting boundaries be enforced outside the modelAWS publishes a CJIS-oriented RAG reference architecture on Bedrock for municipal law enforcement intelligence units, priced under $200 a month at POC scale
AWS-backed campus programs are framed as AI workforce pipelines, without outcome measures
Virginia Tech's CyberSafe AI curriculum and Pitt's AI Cloud Innovation Center both present AWS support mainly as building AI and security skills: free lessons for high schools and colleges, and paid student prototyping. Both report reach or anecdotes, not learning outcomes or adoption of what they build. Pitt notes its students are hired away quickly, which hurts continuity.
Operating questionIf we join or replicate a vendor-supported AI education program, what learning or adoption outcomes will we measure, and who sustains the outputs?
Supporting evidenceVirginia Tech (Virginia Cyber Range / U.S. Cyber Range); AWS; Commonwealth Cyber InitiativeUniversity of Pittsburgh (Pitt Digital); AWS
Evidence ledger
Full record · every source keeps its link and limitations
AWS publishes a CJIS-oriented RAG reference architecture on Bedrock for municipal law enforcement intelligence units, priced under $200 a month at POC scale
An AWS solutions architect who works with state and local agencies describes a retrieval-augmented generation (RAG) tool on Amazon Bedrock Managed Knowledge Base. It lets law enforcement analysts ask natural-language questions of case files and CJIS records and get cited answers. The post argues that CJIS Security Policy v6.1 does not mandate a specific provider or FedRAMP level, so commercial us-west-2 is viable when CJIS is the main driver. GovCloud is recommended when FedRAMP High, ITAR or IL4/IL5 also apply. Controls include customer-managed KMS encryption, CloudTrail, full prompt-response invocation logging, and ACL-aware retrieval that fails closed. AWS estimates $78-$191 per month for about 5 GB of documents and 2,000 queries.
Why it matters, evidence and limitations
- Why it matters
- Directly relevant to municipal and county police intelligence units and state fusion centers that handle CJI. It also matters to state CJIS Systems Agencies, which the post says assess compliance. Cross-tagged to public-safety because the use case is law-enforcement records.
- Evidence and measured results
- Vendor-authored reference design. The 'municipal intelligence unit' is a hypothetical scenario, and no agency deployment, retrieval-accuracy test, or user study is reported. The cost table is an AWS estimate for a proof-of-concept workload (about 5 GB, 2,000 queries a month) using list prices, including $4.00 per 1,000 agentic retrieval calls versus $1.00 for standard Retrieve. Regulatory statements (CJIS v6.1, June 2026; the 2021 shift to a technical-controls model) are AWS's characterization.
- Limitations and uncertainty
- Vendor guidance with no measured outcomes. Cost figures are estimates at small scale and exclude application build, identity integration and staffing. Commercial-region viability depends on each state CSA's interpretation and the CJIS Security Addendum. The excerpt is AWS's own disclaimer, not an independent ruling.
AWS public sector guidance proposes a 30-minute 'delegation audit' for Bedrock AgentCore agents, insisting boundaries be enforced outside the model
AWS authors propose a whiteboard audit: draw every handoff from user to agent, to tools, to data. At each arrow, ask five questions (boundary check, worst single failure, reversibility, who gets hurt, what risk is accepted) and mark it red, yellow or green. Any boundary enforced only by the model is red. They recommend a 5-minute injection test with a planted instruction in the knowledge base. They also recommend 'proof-carrying work', where the evidence returned rises with the consequence. Their worked example is an agent updating an eligibility record with caseworker approval and readback. AWS controls named include AgentCore Policy (Cedar), scoped IAM, approval gates and Bedrock Guardrails, with filters positioned as a complement, not a substitute.
Why it matters, evidence and limitations
- Why it matters
- Applies to any state or local agency piloting agents that take actions, such as benefits eligibility updates, ticket creation or resident notifications. The worked example is an HHS-style eligibility record.
- Evidence and measured results
- Vendor guidance with no case study, test results or measured failure rates. The claim that a first pass usually finds several red handoffs is the authors' expectation, not data. It builds on a companion AWS post that was not inspected.
- Limitations and uncertainty
- Self-described triage, not a full security assessment. Vendor-authored, with no evidence the method reduces incidents. Read alongside independent research showing AgentCore's own defaults were overprivileged until late September 2026.
Zenity Labs: one prompt to an exposed Bedrock AgentCore agent could pull IMDS credentials and, via an overprivileged default role, reach every agent in the account-region
Zenity researchers report that AgentCore agents could reach the instance metadata service (IMDS) from inside their Firecracker microVM. Any HTTP-capable tool therefore became a server-side request forgery path, and a single prompt injection returned the agent's temporary IAM credentials. Because the default execution role was scoped to all AgentCore resources in the account-region, those credentials could enumerate and invoke other agents, read all conversations, write persistent memories and retrieve Secrets Manager values. Disclosure began 2025-12-25. AWS moved new agents to IMDSv2-only on 2026-02-14, but the default role was unchanged as of 2026-06-22 and had been substantially hardened by 2026-09-29. Why now: AWS's 28 Oct delegation-audit guidance and the AgentCore CLI 1.0 GA the same day make this independent counterpoint newly relevant for agencies starting AgentCore pilots.
Why it matters, evidence and limitations
- Why it matters
- State and local agencies and universities building public-facing agents on AgentCore (resident assistants, student help, eligibility helpers) would have faced account-region-wide exposure from one public agent under the old defaults. The overview does not say whether agents created before the fixes were updated automatically.
- Evidence and measured results
- Independent security research with proofs of concept and a dated disclosure timeline, published as a five-part series (only the overview was inspected). Corroborated by The Register (9 Oct 2026, updated 12 Oct), which reports that AWS said the research 'misrepresents documented behavior as a vulnerability' and suggested developer error would be required. Zenity responded that the issues did not cross the account boundary and have been fully mitigated. No public-sector victims are reported.
- Limitations and uncertainty
- AWS disputes that this was a vulnerability rather than documented behavior. Zenity is a security vendor with commercial interest in agent security. The issues are reported fixed for new deployments, and residual risk depends on when agents were created and whether roles were customized. Older than the last run; included for its new relevance, not as breaking news.
AWS adds OpenAI GPT-5.6 (Terra and Luna) native APIs and Cross-Region Inference within AWS GovCloud (US) on Bedrock
AWS announced that OpenAI GPT-5.6 Terra and Luna run on the bedrock-runtime endpoint in AWS GovCloud (US), supporting the Responses, Converse and Chat Completions APIs. It also added Cross-Region Inference that routes requests across both GovCloud Regions for throughput and redundancy, which AWS says maintains US data sovereignty. Usage appears in Bedrock invocation logging, CloudWatch metrics (invocations, tokens, latency, throttles, errors) and Cost Explorer/CUR itemization by model. AWS's FedRAMP/IL status page lists GPT 5.6 (Terra and Luna) under OpenAI model families, but I could not reliably map its authorization columns from the page text.
Why it matters, evidence and limitations
- Why it matters
- Gives state agencies and universities with GovCloud workloads (CJIS, IRS 1075, FedRAMP High-aligned) another frontier model family. OpenAI-compatible APIs may ease porting of applications built against OpenAI. This continues the GovCloud model expansion noted in the 29 Oct edition (Claude Haiku 5.5, Grok 4.7).
- Evidence and measured results
- Vendor announcement only. No benchmarks, public-sector evaluations or pricing are given. The GovCloud user guide confirms Bedrock is available in both GovCloud Regions and points to a separate page for FedRAMP Class D and IL4/IL5 status.
- Limitations and uncertainty
- Vendor claim with no performance or evaluation data. The authorization mapping for this model family was not verified from the compliance page. Cross-Region Inference may conflict with contracts or policies that name a single Region.
Axios: Wyandotte and Jackson counties add Granicus's Bedrock-based Government Experience Agent; vendor speed claims stand, but the UG did not answer questions
Axios reports that the Unified Government (UG) of KCK/Wyandotte County added Granicus's AI chatbot to its Treasury page, which receives about 70,000 calls a year. Jackson County uses the same Government Experience Agent (GXA) for Assessment questions, and Olathe uses it on its home page. The speed and timing figures come from Granicus: chats take about 1.3 minutes versus about 2.5 minutes for typical UG 311 calls, and about 36% of questions arrive between 6pm and 9am. The reporter found it unclear where feedback goes, the UG did not respond, and both the UG and Granicus store some chat data. AWS's February 2026 partner post says GXA's conversational intelligence is powered by Amazon Bedrock with RAG over agency-approved content. It reports Jackson County basic inquiries fell about 10% within months and Wyandotte targets a 30% Treasury call reduction.
Why it matters, evidence and limitations
- Why it matters
- A live, multi-jurisdiction example of an AWS Bedrock-powered resident assistant from a major govtech vendor. Cross-tagged to local-government and citizen-engagement because the deployments are county resident-service channels.
- Evidence and measured results
- Independent reporting, but the quantitative figures are attributed to Granicus company data, not county measurement. The AWS link and the 10%/30% figures come from vendor sources (AWS partner blog, Feb 2026; Granicus customer story), both inspected. Granicus's own story notes that testing found an incorrect phone number pulled from an old press release. No independent accuracy audit is reported, and the outlet's question about the UG's results went unanswered.
- Limitations and uncertainty
- AWS involvement is established through vendor sources, not the Axios article, which does not mention AWS. Call and time figures are vendor-supplied aggregates 'across many government agencies'. The 70,000 Treasury calls (Axios) and 310,000 total calls (AWS blog) describe different scopes. Outcomes for the UG are a goal, not a result.
Virginia Tech's Cyber Range launches AWS-supported CyberSafe AI curriculum and game teaching students AI security risks, from hallucinations to prompt injection
With AWS and Commonwealth Cyber Initiative support, the Virginia and U.S. Cyber Ranges offer CyberSafe AI: free instructional materials plus a browser game with six lessons and five levels. It covers hallucinations, data privacy, AI-enabled phishing, deepfakes, prompt injection and risks of autonomous agents. No Cyber Range affiliation is required. The ranges serve Virginia public high schools, community colleges and universities. Reach figures: 85,000+ users over a decade, 600,000+ virtual machines deployed, and nearly 400 schools, 31 states and nine countries per an AWS executive. The AWS collaboration is also developing AI tools for customer support, knowledge management and developer productivity.
Why it matters, evidence and limitations
- Why it matters
- Offers K-12 and community colleges a free, AWS-backed AI-security literacy resource. Cross-tagged to k12 because the Virginia Cyber Range serves public high schools.
- Evidence and measured results
- Institutional announcement with AWS and program-director quotes. Usage figures are cumulative platform figures for the Cyber Range, not CyberSafe AI. No learning-outcome data or evaluation of the curriculum is reported.
- Limitations and uncertainty
- Vendor-supported program announcement with no learning-outcome evaluation. Reach numbers mix the platform's whole history with this new initiative. The AI tools for support and knowledge management are mentioned without detail.
Pitt's AWS-supported AI Cloud Innovation Center enters its second year with expanded scope, open-source prototypes and openness to local government projects
Pitt's AI Cloud Innovation Center (CIC), run by Pitt Digital with AWS, gives students funding, AWS tools and an on-campus AWS solutions architect to build solutions for faculty and staff in weeks. Pitt describes it as one of only three Amazon-supported CICs and the only one on the East Coast. The initial one-year contract focused on health sciences and sports analytics and has been extended and broadened. The center is open to projects from local government and nonprofits. In one example, a student built a program in eight weeks that matched clinical codes across a 40-million-row dataset 'with high accuracy', released as open source. Leaders say students are quickly hired away.
Why it matters, evidence and limitations
- Why it matters
- Shows a university-AWS model that produces prototypes and AI-skilled graduates, and that may take local-government projects. That is relevant to research universities and nearby municipalities. Cross-tagged to research for its research-support function.
- Evidence and measured results
- Institutional feature with staff and student quotes. The 'high accuracy' claim has no metric, method or validation, and the 'one of three CICs' claim is Pitt's statement. No count of projects, cost, or downstream adoption is reported.
- Limitations and uncertainty
- Promotional institutional story. Outcomes are anecdotal. Student turnover, which the center itself cites, threatens continuity and maintenance of prototypes.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.
- Independent research
- Research conducted outside the implementing organization.
- Independent reporting
- Independent reporting with attributable sources but without a formal evaluation design.