A multi-account setup a two-to-twenty person team can run without a platform team: which accounts to create, three service control policies worth having on day one, human access through IAM Identity Center, and CI access through OIDC.
Read ArticleAsk a coding agent for an orchestrator role that launches ECS tasks and you will often get ecs:* and an unconditioned iam:PassRole. Here is the escalation path when a privileged role trusts ECS, the scoped version, and a checklist for reviewing agent IAM before merge.
Read ArticleAgents that write and run code need a sandbox, and a default Docker configuration is not sufficient for every threat model. What containers share with the host, when to reach for gVisor or a microVM, and a hardened docker run you can use today.
Read Article