CI gates for Cursor Cloud Agent pull requests on AWS CDK: blast-radius limits, tsc and cdk synth, cfn-lint, a template gate for wildcard IAM and AdministratorAccess, CODEOWNERS and Cursor project rules.
Bedrock Agents + EventBridge: offload long tools with start/status APIs, correlation IDs, and fail-closed IAM so sessions stay interactive while workers run the slow path.
EventBridge Pipes to Lambda done safely: fail-closed filters, idempotent enrichment, partial-batch failures, and DLQs — so agent and order pipelines do not silently drop events.