For the technical reader
The architecture,
wired.
How a Bedrock-powered AI Agent, a Lambda + API Gateway page engine, and an Innovation Sandbox provisioning loop combine into a single platform. AWS-native, end-to-end. Same patterns the AI Morning Brief already runs in production.
01 — Stack overview
Three layers.
Each on AWS.
The platform is structured as three independent layers. The customer-facing edge, the serverless logic that drives every workflow, and the data plane that holds tenant state and content.
Every tenant gets a subdomain. Edge cached globally, WAF-protected, TLS terminated automatically. The customer-facing artifact loads in under 200ms from anywhere in Europe.
Every operation is a Lambda function. Page rendering, content APIs, AI synthesis, sandbox provisioning, workshop lifecycle. Pay only for execution. No idle servers. Scales from 1 to 1000 tenants without architecture change.
Tenant config and session state live in DynamoDB. Per-tenant assets in S3. Learner identities in Cognito. The AI Agent runs on Bedrock with Knowledge Bases for grounding. Every claim cites its source URL.
02 — The AI Agent
A research agent,
built on Bedrock.
Customer name in. Structured research out. Six steps, orchestrated by Step Functions, each step a single-purpose Lambda. Same pattern the AI Morning Brief runs daily in production — repointed from "the AI industry" to "one customer."
Crawls the customer's web presence — site, annual report, news, LinkedIn, job postings. Output is raw text indexed by source URL.
Bedrock call classifies the customer: industry, regulatory frame (MDR, GDPR, NIS2, DORA, EU AI Act), risk profile, geographic footprint.
Bedrock call infers likely tech stack from job postings and LinkedIn, organisational structure, current AI adoption level.
Bedrock call with full prior context drafts 5 pain points, 5 low-hanging fruits, 6 CISO objections, 3 ship-next-week ideas. Every claim cites its source URL. Guarded by Bedrock Guardrails.
Findings written to DynamoDB as a structured customer profile. Claims, sources, confidence scores. Auditable, refreshable, queryable.
Email sent to the founder with a review URL. Each claim shown side-by-side with its source. Approve, edit, or kill per claim — page only goes live on explicit approval.
Why Bedrock for this layer.
Customer research is public data going in, public-facing output coming out — Bedrock is the AWS-native fit. Knowledge Bases ground the synthesis in real source URLs. Guardrails prevent the agent from hallucinating customer-specific claims. Every model call is observable in CloudWatch.
03 — The page engine
One Lambda.
Many customers.
A single PageRenderer Lambda + one template + one tenant row in DynamoDB = one rendered customer page. Adding a customer is one INSERT, not one project. Same code path for tenant #1 and tenant #500.
04 — The workshop pipeline
Provision.
Run. Reap.
When a workshop is scheduled, Step Functions orchestrates the lifecycle: Innovation Sandbox accounts vended per learner, environment provisioned, learner notified. On workshop end, accounts torn down. Zero residual cost.
workshop.scheduled
Account manager schedules a workshop. EventBridge fires the lifecycle event. Step Functions starts provisioning workflow.
Step Functions
sandbox.provisioning
SandboxProvisioner Lambda calls Innovation Sandbox APIs. N accounts vended (one per learner), tagged with tenantId and workshopId.
Innovation Sandbox
sandbox.ready
Starter CloudFormation template applied. Workshop environment ready. Learners receive Cognito-issued credentials by email.
Cognito · SES
workshop.running
Learners join. SessionTracker Lambda logs progress. ContentAPI serves section content lazily. CloudWatch surfaces real-time per-learner state.
CloudWatch
workshop.ended
SandboxReaper Lambda tears down all vended accounts. State persisted for audit. Per-tenant cost report generated.
Innovation Sandbox
05 — Why this scales
Same code path.
Many customers.
Adding a customer is a database row. Adding a workshop is an API call. Adding a learner is a Cognito user. No architectural changes between 1 customer and 50. AWS consumption growth tracks customer count directly.
06 — One company, two AI strategies
Bedrock here.
Air-gapped there.
The studio uses AWS-native cloud AI for customer research. The flagship product — our autonomous AI Agents for NOC and SOC operations — runs on-premise with open-weight models. Each strategy matched to its data sensitivity.
AWS Bedrock — cloud-native, fast, observable
Public data going in, public-facing output coming out. Bedrock is the right choice: Knowledge Bases for grounding, Guardrails for safety, CloudWatch for observability, full AWS billing integration. Credit-eligible. Easy for AWS reps to advocate internally.
On-premise open-weight models — sovereign, air-gappable
Customer telemetry from regulated industries (defence, energy, telecom) cannot leave the perimeter. Open-weight models fine-tuned locally on NOC/SOC data. No external API calls, no model-update phone-home. Audit logs suitable for defence-grade review.
07 — Go deeper