Every interaction is logged. IAM helpers align with Amplify guidance, and the rules audit highlights ongoing hardening work—from eliminating unsafe `any` usage to ensuring every page carries Suspense-ready loading states.
- Audit Logging Everywhere
- DynamoDB-backed AuditLog model, activated helper functions, and per-resource metadata keep regulators satisfied.
- Tenant-Aware IAM & S3 Policies
- Scripts enforce Bedrock inference profile access and scoped document paths, matching the documented S3 rewrite.
- Strict TypeScript Everywhere
- Zod-first validation, lint guards, and no `any` rules protect API boundaries and server actions.
- Observability Playbook
- CloudWatch pipelines, knowledge base sync telemetry, and cost dashboards catch issues before clients do.