Tagged
Week one: a catch-all Lambda wraps Shopify Admin. The prompt says read-only. cancel and refund are still in the schema. Browser off — support pilots with Browser hot ran roughly 3× the spend.
A shopper updates their address in the account UI. Next chat, the agent cites the old address from Memory. Use tools for facts. runtimeSessionId must be at least 33 characters.
The serial-returner spreadsheet becomes "you are fraudulent" in a ticket. Risk bands stay internal. High freezes auto-refund. A person still owns the accusation. The ~$791/mo platform cost floor at 50,000 sessions is planning cost, not fraud recovered.
Store-connected agents fail at secrets, PII, and payment tools — not at prompts. Support-shaped pilots tracked roughly 3× spend when a browser tool stayed on for lookup turns. Delete payment tools.
On August 19, 2026 AWS enabled live-web fetch for Bedrock Web Search in 3 US Regions. Default external_web_access is true; AmazonBedrockFullAccess still does not grant ExternalWebAccess — and the 403 does not fail the request.
After Cognito multi-Region replication (June 2026), a B2B API platform (~18k RPS peak) cut auth-related 5xx during a regional drill from 4.2% → 0.1% — but a missing WAF rate rule still let a scraper burn $1.8k in a weekend.
After the April 2026 S3 default that blocks SSE-C on new buckets (and on existing buckets in accounts with zero SSE-C objects), a SaaS media platform (~2.4 PB, 418 buckets) found 11 legacy upload paths still sending customer-key headers — all failing 403 until migrated to SSE-KMS.
Shield Advanced is $3,000/mo per org plus DTO fees — for a consumer marketplace (~180M req/mo CloudFront), cost protection credited $41k in scaling charges after a 38-minute L7 event when WAF rate rules were pre-configured.
On a B2B SaaS crossing Series A (~$18.5k/mo AWS), running the funding-stage gate checklist before the B round cut diligence prep from 11 weeks to 4 — Organizations split, WAF, and SOC2 evidence path without re-platforming.
Before a partner-led WA Review, a fintech workload with 23 open HRIs spent 6 weeks on unfocused fixes; after the readiness checklist and HRI cap of 5 for 90 days, the next milestone dropped High Risk items from 23 to 7 in one review cycle.
On a defense-subcontract SaaS (~$42k/mo AWS, CUI in scope), choosing GovCloud (US) over commercial US-East cut inherited-control review from 11 weeks to 4 — after mapping 47 customer-responsibility controls in the SSP inheritance worksheet.
Most remote-access RFPs still default to full Windows desktops — but 60%+ of contractor work is browser-only. WorkSpaces Secure Browser isolates SaaS in AWS; WorkSpaces Applications (formerly AppStream 2.0) streams fat clients without a desktop. A composite regulated services firm cut 3 legacy VDI vendors to 2 OU-scoped patterns and reduced unmanaged-endpoint incidents from ~9/quarter to ~2 after splitting browser vs app streaming.