AI agent controls, backup recovery and cloud capacity

Review AI agent controls · AI and platform teams

AWS AgentCore adds Step Functions tools for AI agents

Agents can now invoke existing AWS Step Functions workflows through Amazon Bedrock AgentCore Gateway. AWS announced the connector on 29 October. It supports Standard and Express workflows and is available wherever AgentCore Gateway is supported. AWS launch announcement.

The agent chooses when to request an operation and supplies its inputs. The workflow defines the execution sequence. A service-provisioning workflow is one candidate to evaluate: the agent submits a request, while the workflow enforces the required checks and approvals.

The permission model deserves a close read. Some connector operations are pinned to a specific workflow. Others act on execution identifiers or task tokens and depend on the gateway’s IAM permissions. An agent holding a valid callback token can complete the corresponding task. Connector permissions and task-token constraints.

CloudHero’s take: keep approval authority outside the agent that requests the action. A human approval step needs its own protected path, including its callback token. This extends issue 001’s review of agent permissions and revocation.

Act now if affected Backup recovery · Microsoft 365 owners and MSPs

ConnectWise Cloud Backup recovery requires tenant verification

Re-authorising a Microsoft 365 tenant does not establish that its backups have resumed. ConnectWise’s 30 October update says backup and restore capabilities are available for re-authorised tenants, with customer access and monitoring dashboards restored. Reporting and notifications remain in phased recovery. ConnectWise restoration advisory, updated 30 October.

This follows the Cloud Backup incident, formerly SkyKick, covered in last week’s edition. ConnectWise previously reported unauthorised access to application credentials. Its current guidance requires partners to verify successful new snapshots and continue reviewing affected environments. Previously disabled applications should stay disabled unless ConnectWise specifically instructs otherwise.

CloudHero’s take: close recovery against tenant-level evidence. Assign an owner to confirm backup resumption, restore-test results and outstanding security-review work.

Evaluate Real-time data · Data engineering and platform teams

Databricks real-time pipelines reach general availability

Real-time mode in Lakeflow pipelines is generally available on classic and serverless compute. Databricks’ 29 October release notes describe end-to-end latency as low as five milliseconds. Multiple real-time flows and adaptive source repartitioning remain Beta. Databricks release notes.

For teams already using Databricks, this is a processing option to benchmark when a shorter response time changes an operational decision. Check compatibility first: stream-to-stream joins are unsupported. Concurrent stages need enough compute, and checkpoint frequency affects overhead and recovery time. Real-time mode documentation.

CloudHero’s take: start with the decision the data supports. Telecom event analysis or utility telemetry may warrant evaluation; safety-critical control requires a separate suitability assessment. Ask what a faster response changes before paying to sustain it.

Plan Cloud capacity · Engineering leaders and delivery teams

Microsoft reports Azure growth alongside capacity constraints

Microsoft reported Azure revenue growth of 48% year over year in its 28 October results. Management said demand continued to exceed supply and described delayed third-party capacity deliveries. It also linked growth to better use of existing CPU and GPU infrastructure. FY27 Q1 results and earnings call.

These company-wide signals do not establish a shortage in your chosen region or service. They do justify checking availability early, particularly when data-location requirements rule out moving a workload elsewhere.

CloudHero’s take: include infrastructure efficiency in delivery planning. Reducing a workload’s resource requirement can make an existing allocation go further while lowering its unit cost.

Watch Energy-aware inference · Cloud and network teams

Lumen and Emerald AI explore energy-aware inference routing

Lumen and Emerald AI are exploring a pilot to route AI computing according to power availability and cost. Their 29 October announcement describes moving inference requests between locations while accounting for network performance, latency and security. It establishes neither a generally available service nor demonstrated production savings. Lumen announcement.

CloudHero’s take: identify which inference requests can move between approved locations and which must remain local. That classification is useful for capacity and resilience planning today. Include data movement, latency and contractual requirements before considering energy cost.