AWS wellarchitected high security documentation change
Summary
Added generative AI governance requirements, continuous model monitoring guidelines, human-in-the-loop controls, and autonomous agent management frameworks. Removed outdated topics section.
Security assessment
Added explicit requirements for hallucination detection, output validation, incident response runbooks, and permission boundaries for autonomous agents. These directly address security risks like unauthorized actions by AI agents, model manipulation, and uncontrolled AI behavior in financial systems.
Diff
diff --git a/wellarchitected/latest/financial-services-industry-lens/operational-excellence.md b/wellarchitected/latest/financial-services-industry-lens/operational-excellence.md index 04ee8ae0b..7e32204d0 100644 --- a//wellarchitected/latest/financial-services-industry-lens/operational-excellence.md +++ b//wellarchitected/latest/financial-services-industry-lens/operational-excellence.md @@ -11,21 +10,0 @@ The operational excellence pillar allows financial services institutions to focu -###### Topics - - * Design principles - - * Definitions - - * [Organization](./organization.html) - - * [Prepare](./prepare.html) - - * [Operate](./operate.html) - - * [Evolve](./evolve.html) - - * [Key AWS services](./opex-key-aws-services.html) - - * [Resources](./opex-resources.html) - - - - @@ -41,0 +21,6 @@ In addition to the design principles in the AWS Well-Architected Framework white + * **Establish generative AI-specific governance and oversight mechanisms:** Financial institutions must implement specialized governance frameworks for generative AI workloads that address model risk management, output validation, hallucination detection, and ethical AI considerations. This includes establishing clear accountability for generative AI model selection, deployment, and ongoing monitoring in production environments. + + * **Implement continuous model performance monitoring:** Unlike traditional applications, generative AI models can exhibit performance drift, bias amplification, and unexpected behaviors over time. Establish continuous monitoring of model outputs, accuracy metrics, and alignment with intended use cases to ensure consistent and reliable performance in regulated environments. + + * **Maintain human-in-the-loop validation and control:** Financial institutions must ensure appropriate human oversight and intervention capabilities for generative AI systems, particularly for decisions that impact customers, regulatory compliance, or financial outcomes. Financial services workloads should be continually reviewed and prioritized regarding their risk impact to the overall business (for example, based on their reputational, financial, or regulatory impact). Clear roles and responsibilities should be defined in the organization to understand the risks involved in the delivery of business value using cloud services. + @@ -53 +38,11 @@ Financial services workloads should be continually reviewed and prioritized with - * **Third line of defense:** Internal auditors provide the governing body and senior management with comprehensive assurance based on the highest level of independence and objectivity within the organization. + * **Third line of defense:** Internal auditors provide the governing body and senior management with comprehensive assurance based on the highest level of empowerment and objectivity within the organization. + + * **Agent governance framework:** Establish dedicated governance structures for autonomous agents with clear boundaries, permissions, and escalation paths. + + * **Agent monitoring:** Implement specialized monitoring for agent activities, decisions, and outcomes with human oversight thresholds. + + * **Agent lifecycle management:** Define processes for agent deployment, versioning, and retirement. + + * **Incident response for agents:** Create specific runbooks for incidents involving autonomous agents, including containment procedures. + + * **Agent feedback loops:** Establish mechanisms to capture and incorporate feedback on agent decisions and actions.